HTB Paperwork Complete Writeup - LPD Command Injection, PJL Path Traversal & SCM_RIGHTS FD Leak

A comprehensive penetration testing guide exploiting a classic shell=True command injection in an LPD print server, leveraging PJL filesystem path traversal to plant an SSH key and pivot to a higher-privileged user, and abusing SCM_RIGHTS ancillary data over a Unix domain socket to leak a root-owned file descriptor and bypass filesystem permissions entirely.

July 22, 2026 • views • 11 min read • 1,236 words

By

Havoc

hackthebox 30 htb 34 linux 14 easy-difficulty 3 printer spooler lpd line-printer-daemon rfc-1179 command-injection 2 shell-injection subprocess shell-true reverse-shell 4 jetdirect pjl printer-job-language path-traversal 2 directory-traversal fsdownload ssh-key authorized-keys privesc privilege-escalation 21 unix-socket unix-domain-socket scm-rights file-descriptor fd-leak ancillary-data os-pread permission-bypass root-password su lp archivist root 2 nginx 3 virtual-host vhost source-code server-py jetdirect-py corposite decoy rabbit-hole season11 8 educational beginner-friendly