Paperwork
lp) → an internal PJL/JetDirect service allowing arbitrary file read/write via
path traversal (used to inject an SSH key as archivist) → a root daemon that
leaks an already-open privileged file descriptor over a Unix socket, exposing a reused
administrator password → root.
01Why the full writeup is held back
Paperwork is a live Season 11 machine, so — in line with Hack The Box's guidance on active machines — I'm not publishing a step-by-step reproduction. The complete writeup (LPD injection, PJL traversal, SSH key injection and the descriptor-leak privesc, with commands and remediation) goes live here once the season closes.
02The interesting bits (no spoilers)
Command injection in a bespoke print daemon
The foothold wasn't an off-the-shelf CVE — it was shell command construction inside a custom Line Printer Daemon, where a print-job field flowed unsanitised into a system command. Custom network services are where the interesting bugs hide.
The rarely-seen one: leaking a privileged file descriptor
The privilege escalation is the standout — a root-owned management daemon passed an already-opened,
root-privileged file descriptor to a client over a Unix socket via SCM_RIGHTS. Receiving
that descriptor gave read access to a file the user could never open directly; it held an admin password that
was reused for root. A genuinely uncommon primitive to see in the wild.
03Takeaways
- Never build shell commands from untrusted input — even in "internal" services like a print daemon.
- Path handling in PJL/JetDirect is a real read/write primitive — printers and their protocols are attack surface.
- Passing file descriptors with
SCM_RIGHTSbypasses file permissions — the receiver inherits the sender's access; scope it tightly. - Password reuse turns any leak into full compromise — the whole chain collapsed on one reused admin password.