Paper

Platform: HackTheBox | Difficulty: Easy | OS: CentOS Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Paper (CentOS, attack surface: Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9) (443), Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9) (80), OpenSSH 8.0 (protocol 2.0) (22)). Foothold via the vulnerable entry point; privilege escalation via sudo. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.143 --min-rate 1000

Enumeration highlights

• Detected OS: CentOS.
• Open services: http (80), ssh (22), ssl/http (443).
• Scan used: nmap -p- -sVC 10.10.11.143 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.143 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-22 20:39 PDT
Nmap scan report for 10.10.11.143
Host is up (0.077s latency).
Not shown: 64783 closed tcp ports (conn-refused), 749 filtered tcp ports (no-response)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey: 
|   2048 1005ea5056a600cb1c9c93df5f83e064 (RSA)
|   256 588c821cc6632a83875c2f2b4f4dc379 (ECDSA)
|_  256 3178afd13bc42e9d604eeb5d03eca022 (ED25519)
80/tcp  open  http     Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9)
|_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: HTTP Server Test Page powered by CentOS
|_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
443/tcp open  ssl/http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9)
|_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28
|_http-title: HTTP Server Test Page powered by CentOS
| http-methods: 
|_  Potentially risky methods: TRACE
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=Unspecified/countryName=US
| Subject Alternative Name: DNS:localhost.localdomain
| Not valid before: 2021-07-03T08:52:34
|_Not valid after:  2022-07-08T10:32:34
|_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 56.47 seconds

1. Based from the nmap result, the machine runs a webapp (http and https), also it opens a ssh login.

2. Capturing the request using burpsuite, found another endpoint --> office.paper.

office.paper

1. It's a wordpress blog. Found an interesting comment at this post:

2. This should be a hint, we can interpretes that there's must be a confidential information around.

3. Anyway this took me a while until I realized the wordpress version has CVE documentation.

WORDPRESS VERSION

CVE DOCUMENTATION --> https://www.exploit-db.com/exploits/47690

1. Great! We can view a private posts.

2. It seems we need to use --> http://chat.office.paper/register/8qozr226AhkCHZdyY , so we can register.

3. After registering account, login with the same cred.

4. Reading the general you shall find a bot named Recycle, based from the chat history we can chatting with bot.

5. There's several commands we can use.

6. We can list files at the remote server and we can see the content.

7. Long story short, found the user.txt at the / directory.

8. But we can't see the content, because only root can read the file.

9. As we know, we're accessing the server as dwight.

10. Running --> reyclops file../../../../../etc/passwd, we can identified another user named rocketchat.

11. Stuck for a while, until I realized there's a directory named hubot that dwight can access.

12. Checking the .env file we shall find a password for rocketchat (?)

13. Here's what's unique, we found 2 users -> rocketchat & dwight. Somehow the password we found is the correct password for dwight when running ssh.

.env

GETTING USER FLAG | cred --> dwight:Queenofblad3s!23

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

NOTES:

It is a best practice to download and run file at /tmp directory.

1. Great! Let's change user to --> anjay-win, input password then run sudo bash to obtain root (based from the response we got before).

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.