Abducted is a Linux box running Samba. I’ll exploit a command injection in Samba’s printing subsystem, where a client-controlled print job name is passed to a shell without escaping, to get a foothold. From there, I’ll find an rclone backup config with an obfuscated password, decode it with rclone, and use it to access the next user. That user owns a Samba share configured to follow wide links and to run as a third user, which I’ll abuse to drop an SSH key into that user’s home directory and log in. The final user belongs to a group with write access to the smbd systemd drop-in directory and a polkit rule permitting them to restart the service, so I’ll add an ExecStartPre command that creates a SetUID bash and get root.

0xdf hacks stuff

A walkthrough of the HackTheBox machine 'Abducted', a Linux box exploited through multiple chained vulnerabilities. The initial foothold uses CVE-2026-4480, a command injection in Samba's printing subsystem where the print job name (%J substitution) is passed to the shell unescaped, allowing RCE as nobody. Lateral movement to scott is achieved by decoding an obfuscated rclone backup config password. Access to marcus is gained by abusing a Samba share configured with wide links and force user, allowing an SSH key to be planted in marcus's home directory via SMB symlink traversal. Root is obtained by writing a malicious ExecStartPre directive to the smbd systemd drop-in directory (writable by the operators group) and restarting smbd via a polkit rule that permits operators to manage that specific service.

HTB: Abducted