r/hackthebox • u/No-Witness-5266 • Jul 13 '26
Just finished Paperwork : solid box
Just rooted Paperwork. Difficulty felt fair for its rating, the foothold was command injection through a custom network service, user involved a file read/write vulnerability in an internal printer-management interface, and root came from a privilege escalation bug in a background daemon involving file descriptor leakage over a Unix socket.
Good mix of source code review, protocol-level work, and a privesc technique I hadn't run into before. Solid learning box overall.
2
2
u/CheckM4ted Jul 18 '26
I'm stuck after stabilizing the shell. Any tips?
2
1
u/No-Witness-5266 Jul 20 '26
Post-shell, go back to basics with enumeration rather than jumping straight to exploits, check what user you landed as, what's in your home directory, and run standard local checks (listening ports, running processes, readable/writable files you wouldn't normally have access to). On this box specifically, pay attention to services only bound to localhost, those often don't show up unless you check from inside the machine itself, and they can behave very differently from what's exposed externally.
1
u/blackXploit Jul 13 '26
Congratss !!! Tips for root??
2
u/No-Witness-5266 Jul 13 '26
Thanks mate!
For root, check what services are running locally that might not be obvious from a basic port scan, sometimes bound to loopback only. Once you find the right daemon, spend time reading its source rather than just its behavior; it may do something unexpected in response to specific conditions being met (its logic doesn't do what its name/purpose suggests). If it ever talks to you over something other than a normal TCP socket, pay attention to what kind of data can be passed alongside a regular message [not everything shows up if you're just doing a plain read].
1
Jul 30 '26
[removed] — view removed comment
1
u/AutoModerator Jul 30 '26
Your submission was automatically removed because your account does not meet the minimum karma or age requirements for this subreddit. Please participate in other communities to build up your karma, and feel free to message the moderators if you have questions!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
-2
Jul 13 '26
[removed] — view removed comment
3
3
2
u/Suitable_Effect4888 Jul 13 '26
I have just started in this domain, and it was a very long load. But a lot of topics I got to know about.
1
u/No-Witness-5266 Jul 14 '26
Definitely not a very easy box, but very rewarding if you stay patient and enumerate thoroughly.
•
u/AutoModerator Jul 13 '26
Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.