search

Return Write-up - HTB

hashtag
Recon

Ran an nmap scan:

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: HTB Printer Admin Panel
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-24 12:07:15Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49671/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49675/tcp open  msrpc         Microsoft Windows RPC
49679/tcp open  msrpc         Microsoft Windows RPC
49682/tcp open  msrpc         Microsoft Windows RPC
49694/tcp open  msrpc         Microsoft Windows RPC
59525/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows

Seems like we have a DC ahead!

hashtag
Enumeration

HTTP, SMB and LDAP seem to be up for enumeration phase.

hashtag
SMB:

SMB seems empty:

hashtag
LDAP:

Based of the LDAP Enumeration results, we are dealing with a printer:

Tried other listings, but we only DSE root listing is enabled by no bind.

hashtag
HTTP:

I tried various things on this form, but I think I was over-complicating something too easy.

Catch the request in Burp.

So what do we now from the form? This is a printer over LDAP. It tries to connect to LDAP Port.

Let's utilize this in our favor by sending this request to our kali box.

First in order to sucessfully receive this request we need to set up netcat to listen on port 389.

Then send the request with your kali IP.

Sweet!

Since port 5985, WinRM is open, let's go ahead and use it with our fresh credentials!

hashtag
Privilege Escalation

hashtag
Permissions:

Running a whoami /all to check our local privileges:

WILD!!!!!!!!!!!!!!!!!!!!!!!!! We just hit Jackpot baby!!!!!!!!!!!!!!

Now simply:

It couldn't get easier than this wTf.

PreviousTimelapse Write-up - HTBNextDriver Write-up - HTB

Last updated