Printer Shares picoCTF 2026 Solution

Description

1. Step 1Enumerate SMB shares

   Observation

   The description mentions a network printer and a print server, which means SMB. List the available shares with a null session.

   List shares using smbclient -L. The -N flag performs a null/anonymous bind - no username or password needed.

   bash

   smbclient -L //<HOST> -p <PORT_FROM_INSTANCE> -N

   Copied!

   Expected output

   	Sharename       Type      Comment
   	---------       ----      -------
   	shares          Disk
   	IPC$            IPC       IPC Service

   What didn't work first

   Tried: Run nmap with smb-enum-shares against the host and port before trying smbclient.

   nmap's SMB scripts assume port 445 and do not take a port override the way smbclient does, so on a non-standard port they probe the wrong socket and report no SMB service at all. smbclient passes the port straight through to the connection.

   Tried: Omit -N and let smbclient prompt for a password, then press Enter for a blank password.

   Without -N, smbclient still tries to authenticate and may send an empty-string credential rather than a true null session. Some Samba configurations reject a blank password while allowing a genuine null bind. -N asks for the null session explicitly.

   Learn more

   SMB (Server Message Block) is the file-sharing protocol used by Windows and Linux (via Samba). Network printers frequently use SMB to receive print jobs - documents are sent to a shared print queue folder, and the printer processes them in order. This "print spooler" mechanism means print jobs may temporarily exist as files on the server before printing.

   The smbclient -L command lists all shares advertised by the server. A typical output includes share names, types (Disk, Printer, IPC), and comments. The IPC$ share (Inter-Process Communication) is always present and used for management; ADMIN$ and C$ are administrative shares requiring admin credentials; custom shares like "shares" or "print" are application-specific.

   Network discovery tools for SMB include: nmap -p 445 --script smb-enum-shares (structured enumeration), enum4linux (comprehensive SMB info gathering), and crackmapexec smb HOST (modern all-in-one SMB tool). These provide more information than bare smbclient -L but are blocked by many enterprise firewalls and IDS systems. For more on the broader recon toolkit see Networking tools for CTF.

2. Step 2Connect to the 'shares' share

   Observation

   The enumeration lists a share named 'shares' next to the standard IPC$ management share. That is the application-level one, where print job files live.

   Connect anonymously to the share named 'shares' that appeared in the listing.

   bash

   smbclient //<HOST>/shares -p <PORT_FROM_INSTANCE> -N

   Copied!

   What didn't work first

   Tried: Connect to IPC$ instead of 'shares' because IPC$ always appears in the -L listing.

   IPC$ carries named pipes and management calls, not files. The connection succeeds and the listing comes back empty, because there is nothing stored there. The flag is in the application share alongside it.

   Tried: Use the Windows UNC path format with backslashes (\\HOST\shares) directly in the Linux terminal.

   Backslashes are escape characters in bash, so an unquoted UNC path collapses before smbclient ever sees it. Quote the path, or use the forward-slash form, which smbclient accepts natively.

   Learn more

   Allowing anonymous (null session) SMB access to a share means anyone on the network can read its contents without authentication. This was acceptable on isolated internal networks in the 1990s but is a serious misconfiguration in any modern environment. Many IoT devices, printers, and NAS boxes still ship with anonymous SMB enabled by default.

   The SMB share path format is //hostname/sharename (Unix) or \\hostname\sharename (Windows notation). smbclient accepts either format. When connecting to a non-standard port, -p PORT is required - standard SMB ports are 445 (modern SMB over TCP) and 139 (legacy NetBIOS-over-TCP).

   From a defender's perspective, SMB shares should always require authentication, use least-privilege access control, and be monitored for unusual access patterns. Network segmentation (preventing workstations from directly reaching print servers) and firewall rules blocking SMB from external interfaces are foundational controls.

3. Step 3Download and read the flag file

   Observation

   Once connected, a directory listing shows what is stored there, and flag.txt is the file to pull down.

   List the files in the share and download flag.txt.

   bash

   smb: \> ls

   Copied!

   bash

   smb: \> get flag.txt

   Copied!

   bash

   smb: \> exit

   Copied!

   bash

   cat flag.txt

   Copied!

   Expected output

   picoCTF{5mb_pr1nter_5h4re5_...}

   Learn more

   In real incidents, files accidentally sent to network printers are a significant data leakage risk. Sensitive documents - tax forms, employee records, contracts, medical records - are often printed without people realising that print jobs persist on the print server before and after printing. If the print server is accessible on the network with weak security, anyone can read these files.

   The get command in smbclient transfers the file from the remote share to your local current directory. For investigating all files in a share, mget * (with prompt OFF) downloads everything at once. After downloading, use file and strings to identify file types and search for flags - print jobs may be in PDF, PCL, PostScript, or other printer-specific formats rather than plain text.

   This challenge is an introduction to a real attack technique. In penetration tests, finding sensitive files on misconfigured SMB shares is extremely common - it's one of the first things to check after gaining network access. Password files, configuration backups, HR documents, and source code are frequent finds.

Flag

The print server exposes an SMB share with no authentication required. Anonymous access via smbclient -N reveals flag.txt directly in the 'shares' share.