Hack The Box Return Machine Walkthrough — shaggy

Description: Hey everyone, I’m sharing the walkthrough for the Return machine on Hack The Box. This one covers Active Directory service abuse as an attack vector. Let’s get started. 🍾 🙌 🎉

We start by enumerating ports and services on the target.

We also check SMB for any additional information.

Visiting the web application, we’re greeted by a printer admin interface.

While intercepting traffic we see the app only sends an IP address parameter in its requests.

We set the IP to our own machine and start a Netcat listener. The printer sends us credentials.

With the captured credentials we can connect to the system via WinRM. We navigate to svc-printer’s Desktop and grab user.txt.

Before escalating privileges, let’s check what groups and privileges our user has.

Next we enumerate running services. We notice the VSS (Volume Shadow Copy) service is running.

1*Evil-WinRM* PS C:\Users\svc-printer\desktop> servicesPath                                                                              Privileges Service          ----                                                                              ---------- -------          C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe                         True       ADWS             C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe                     True       NetTcpPortSharingC:\Windows\SysWow64\perfhost.exe                                                  True       PerfHost         "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe"        False      Sense            C:\Windows\servicing\TrustedInstaller.exe                                         False      TrustedInstaller "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"            True       VGAuthService    "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"                               True       VMTools          "C:\WINDOWS\system32\vssvc.exe"                                                   True       VSS              "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2104.14-0\NisSrv.exe"    True       WdNisSvc         "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2104.14-0\MsMpEng.exe"   True       WinDefend        "C:\Program Files\Windows Media Player\wmpnetwk.exe"                              False      WMPNetworkSvc

We upload Netcat to the system.

Then we redirect the VSS service binary path to point at our Netcat listener. The service only needs to be redirected, no binary replacement required.

After stopping and starting the service we receive a SYSTEM shell.

Root flag obtained. Thanks for reading, happy hacking! :)