# Paperwork Writeup - HackTheBox

> Exploit a Linux machine by abusing misconfigured services and weak credentials to gain initial access, then escalate privileges through vulnerable SUID binaries.

- **URL:** https://hackindex.io/writeups/paperwork
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** privilege-escalation, suid, sudo-misconfiguration
- **Access:** Partly password protected
- **Authors:** [Benslates](https://hackindex.io/authors/benslates.md), [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 4 min read
- **Published:** 2026-06-15
- **Updated:** 2026-08-10

Would you like to solve this machine together? Join our discord and/or our [open HTB team!](https://app.hackthebox.com/public/teams/8368)

Domain: **paperwork.htb**

## **Reconnaissance**

Add the target to hosts and run a full TCP port sweep first, then a targeted version scan.

```bash
addhost $TARGET_IP $DOMAIN
# [EXECUTED] echo '10.129.41.131 paperwork.htb' >> '/etc/hosts'
# [+] Added: 10.129.41.131 → paperwork.htb
```

```bash
nmap -p- -T4 --min-rate 1000 --open --max-retries 2 paperwork.htb -oA tcp-ports
# PORT     STATE SERVICE
# 22/tcp   open  ssh
# 80/tcp   open  http
# 1515/tcp open  ifor-protocol
```

```bash
nmap -sC -sV -p 22,80,1515 -T4 paperwork.htb -oA tcp-full
# PORT     STATE SERVICE        VERSION
# 22/tcp   open  ssh            OpenSSH 10.0p2 Ubuntu 5ubuntu5.4 (Ubuntu Linux; protocol 2.0)
# 80/tcp   open  http           nginx 1.28.0 (Ubuntu)
# |_http-title: Intranet | Document Archiving Service
# |_http-server-header: nginx/1.28.0 (Ubuntu)
# 1515/tcp open  ifor-protocol?
# | fingerprint-strings:
# |   TerminalServer, TerminalServerCookie:
# |_    Archive_Printer is ready and printing.
# Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.