Machine Synopsis

`Abducted` is a medium-difficulty Linux machine built around the on-premise file and print server of a professional-services firm. The Samba installation is vulnerable to a print-subsystem command injection (CVE-2026-4480): the client-supplied print job name is passed to the configured `print command` without escaping, and a crafted job submitted over the spooler protocol yields code execution as the print service account. An offsite-backup configuration is then recovered and its password decoded with `rclone`'s own tooling, which has been reused for a system account. A second Samba share configured with `force user` and `wide links` is abused to write an SSH key into a second user's home directory. That user belongs to a group that has been delegated management of the Samba service through `polkit`, and a service drop-in is used to execute a command as `root`.