#ssh-key

HTB Paperwork Complete Writeup - LPD Command Injection, PJL Path Traversal & SCM_RIGHTS FD Leak

Paperwork is a HackTheBox Season 11 Easy Linux machine themed around custom printer and spooler protocol implementations. The exploitation chain begins with an unauthenticated LPD (Line Printer Daemon) command injection vulnerability in server.py, where a job name containing shell metacharacters breaks out of a subprocess.Popen call with shell=True, yielding a reverse shell as the lp user. From lp, the internal JetDirect/PJL service on port 9100 is accessed, revealing a path-traversal vulnerability in jetdirect.py's _translate() function that fails to sanitize .. sequences. This allows writing an attacker-controlled SSH public key to /home/archivist/.ssh/authorized_keys, granting SSH access as the archivist user and capturing user.txt. The final privilege escalation targets a root-owned Unix-socket management daemon (/usr/bin/paperwork-daemon) that monitors /home/archivist/printer/logs/commands.log for suspicious PJL commands. By writing FSUPLOAD into the log, the daemon enters a lockdown branch that sends two file descriptors over the Unix socket using SCM_RIGHTS ancillary data - including the admin_fd opened as root for /etc/paperwork/admin_pins.conf. Receiving this leaked fd grants the archivist user direct read access to the root-only file via os.pread(), bypassing all filesystem permissions and recovering the root password for full host compromise and root.txt.