Back to writeups
HTBmachineEasysolved

Paperwork

12 Jul 2026 · by 0xIDA

Solvers

Paperwork

Author: 0xIDA

Solvers

Platform: HTB · Category: machine · Difficulty: Easy

Box: Paperwork · Easy · Linux · Machine ID 921 · 10.129.42.51

Flags

  • User: e037a476765b317476fb8fe969f88469
  • Root: 351ecea46fb5eeed76c7e708158871b1

Chain

  1. LPD RCE (lp): Port 1515 implements RFC 1179. Control-file job name (J) is concatenated into shell=True → inject ; cmd #. Downloadable server.py documents the sink.
  2. JetDirect PJL (archivist): 127.0.0.1:9100 serves PJL FS API with normpath path traversal from printer root /home/archivist/printer/. FSUPLOAD NAME="0:../user.txt" → user flag; FSDOWNLOAD writes ~/.ssh/authorized_keys (NAME before SIZE in command).
  3. paperwork-daemon FD leak (root): Root daemon watches commands.log for FSQUERY|FSUPLOAD|FSDOWNLOAD. On hit, UNIX socket /run/paperwork/mgmt.sock (archivist-group) sends SCM_RIGHTS with open FD to /etc/paperwork/admin_pins.conf. Password ApparelMortuaryCedar22 → su root → root flag.

Full methodology: /root/ctf/htb/paperwork/WRITEUP.md