--- title: "HTB: Abducted" url: https://daily.dev/posts/htb-abducted-7nhys9rk3 source_url: https://0xdf.gitlab.io/2026/07/07/htb-abducted.html type: article source: "0xdf hacks stuff" published: 2026-07-07T10:36:48.167Z updated: 2026-07-07T10:37:12.384Z tags: ["security", "linux"] reading_time: 21 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HTB: Abducted **[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 21 min read · 0 upvotes · 0 comments ## Summary A walkthrough of the HackTheBox machine 'Abducted', a Linux box exploited through multiple chained vulnerabilities. The initial foothold uses CVE-2026-4480, a command injection in Samba's printing subsystem where the print job name (%J substitution) is passed to the shell unescaped, allowing RCE as nobody. Lateral movement to scott is achieved by decoding an obfuscated rclone backup config password. Access to marcus is gained by abusing a Samba share configured with wide links and force user, allowing an SSH key to be planted in marcus's home directory via SMB symlink traversal. Root is obtained by writing a malicious ExecStartPre directive to the smbd systemd drop-in directory (writable by the operators group) and restarting smbd via a polkit rule that permits operators to manage that specific service. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [HTB — Strutted Writeup: Linux Machine](https://daily.dev/posts/htb-strutted-writeup-linux-machine-x6cn8azui) · InfoSec Write-ups · 1 upvotes · 0 comments - [HTB: CodeTwo](https://daily.dev/posts/htb-codetwo-klj991bhn) · 0xdf hacks stuff · 2 upvotes · 0 comments - [CodePartTwo HTB Walkthrough](https://daily.dev/posts/codeparttwo-htb-walkthrough-gzwjbhyde) · InfoSec Write-ups · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/htb-abducted-7nhys9rk3)