Fuse — HTB Writeup | The Hack Sparrow

Executive summary — Fuse is a domain controller whose real weak point isn't Active Directory itself, but a print-management service (PaperCut Print Logger) that exposes its print logs to the public. A printed document carrying the corporate password in its own filename leaks valid — though expired — credentials, and a lab-specific behavior (the DC periodically resets passwords) forces the password change and the next step to be chained almost atomically. From there, a printer comment leaked over RPC gives the credential for a service account with WinRM, and the final escalation is an HTB classic: SeLoadDriverPrivilege abused to load a signed-but-vulnerable kernel driver (Capcom.sys) and steal SYSTEM's token.

Platform	Hack The Box
Operating system	Windows Server 2016
Difficulty	Medium
Status	Retired
Target IP	`10.129.2.5`

Attack map

[80] PaperCut Print Logger — public print logs
   │  leak usernames + password "Fabricorp01" (inside a printed .docx)
   ▼
[SPRAY]  Fabricorp01 valid but expired (STATUS_PASSWORD_MUST_CHANGE)
   │  impacket-changepasswd (null bind) → new password for bhult
   │  CAUTION: the DC resets expired passwords every few minutes
   ▼
[RPC]  enumprinters leaks: svc-print : $fab@s3Rv1ce$1 (printer comment)
   ▼
[WinRM]  svc-print (SeLoadDriverPrivilege)  (user.txt)
   │  load Capcom.sys (signed but vulnerable driver) via SeLoadDriverPrivilege
   ▼
[ROOT]  ExploitCapcom → token stealing → NT AUTHORITY\SYSTEM → root.txt

1. Reconnaissance

nmap -sT -p- --min-rate 3000 -T4 -Pn -oN m5_allports.txt 10.129.2.5

53 (DNS), 80 (HTTP/IIS), 88 (Kerberos), 135/139/445 (RPC/SMB),
389/636/3268/3269 (LDAP), 464 (kpasswd), 593, 9389 (ADWS), 49666+ (dynamic RPC)

A typical Domain Controller port profile, plus HTTP. Confirming the domain:

nmap -sT -sCV -p53,80,88,139,389,445,636,3268 -Pn \
     --script "ldap-rootdse,smb-os-discovery" 10.129.2.5

dnsHostName: Fuse.fabricorp.local     ldapServiceName: fabricorp.local:fuse$@FABRICORP.LOCAL
OS: Windows Server 2016 Standard 14393   Domain: fabricorp.local   NetBIOS: FUSE

curl -s -i http://10.129.2.5/

<meta http-equiv="refresh" content="0; url=http://fuse.fabricorp.local/papercut/logs/html/index.htm" />

Port 80 redirects to a PaperCut Print Logger, using the fuse.fabricorp.local vhost — the machine's real entry point.

Resumen ejecutivo — Fuse es un controlador de dominio cuyo verdadero punto débil no es Active Directory en sí, sino un servicio de impresión (PaperCut Print Logger) que expone sus registros de impresión al público. Un documento impreso con la contraseña corporativa dentro filtra credenciales válidas — aunque caducadas — y un detalle de comportamiento del laboratorio (el DC restaura las contraseñas periódicamente) obliga a encadenar el cambio de contraseña con el siguiente paso de forma casi atómica. Desde ahí, un comentario de impresora filtrado por RPC da la credencial de una cuenta de servicio con WinRM, y la escalada final es un clásico de HTB: SeLoadDriverPrivilege abusado para cargar un driver de kernel firmado pero vulnerable (Capcom.sys) y robar el token de SYSTEM.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2016
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.2.5`

Mapa del ataque

[80] PaperCut Print Logger — logs de impresión públicos
   │  filtran usuarios + contraseña "Fabricorp01" (en un .docx impreso)
   ▼
[SPRAY]  Fabricorp01 válida pero caducada (STATUS_PASSWORD_MUST_CHANGE)
   │  impacket-changepasswd (bind null) → nueva contraseña de bhult
   │  ¡OJO! el DC restaura las contraseñas caducadas cada pocos minutos
   ▼
[RPC]  enumprinters filtra: svc-print : $fab@s3Rv1ce$1 (comentario de impresora)
   ▼
[WinRM]  svc-print (SeLoadDriverPrivilege)  (user.txt)
   │  cargar Capcom.sys (driver firmado pero vulnerable) con SeLoadDriverPrivilege
   ▼
[ROOT]  ExploitCapcom → robo de token → NT AUTHORITY\SYSTEM → root.txt

1. Reconocimiento

nmap -sT -p- --min-rate 3000 -T4 -Pn -oN m5_allports.txt 10.129.2.5

53 (DNS), 80 (HTTP/IIS), 88 (Kerberos), 135/139/445 (RPC/SMB),
389/636/3268/3269 (LDAP), 464 (kpasswd), 593, 9389 (ADWS), 49666+ (RPC dinámicos)

El perfil de puertos es el típico de un Controlador de Dominio, más HTTP. Confirmando el dominio:

nmap -sT -sCV -p53,80,88,139,389,445,636,3268 -Pn \
     --script "ldap-rootdse,smb-os-discovery" 10.129.2.5

dnsHostName: Fuse.fabricorp.local     ldapServiceName: fabricorp.local:fuse$@FABRICORP.LOCAL
OS: Windows Server 2016 Standard 14393   Domain: fabricorp.local   NetBIOS: FUSE

curl -s -i http://10.129.2.5/

<meta http-equiv="refresh" content="0; url=http://fuse.fabricorp.local/papercut/logs/html/index.htm" />

El puerto 80 redirige a un PaperCut Print Logger, usando el vhost fuse.fabricorp.local — el punto de entrada real de la máquina.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.