Last updated
Last updated
Topology is an easy machine which you have to explore a Latex Injection to get arbitrary file read on the machine in order to read the hash for the user vdaisley , after you crack it you get his password to log in the machine through SSH. On the machine, after an enumeration, you discover a cron routine running gnuplot on all files in a directory you have write permission as. So you must write a malicious plot script to execute a reverse shell to you get root.
The TCP port scan showed no port but the defaults SSH and HTTP ports, so let's take a look in the web page.
At first view, we have a software projects list, which has a link which redirect us to latex.topology.htb, so we can add it and the topology.htb domain to our /etc/hosts and start to fuzzing to see if we get more subdomains.
If we try to access the dev.topology.htb subdomain we get a HTTP form asking our password:
So, let's try to explore the latex subdomain.
Entering the subdomain, we got an Index of listing all the files at the page.
We have a PHP page named equation.php, let's enter it.
We can succefully read a line from the /etc/os-release file on the machine, and if we want we can read more lines just repeating this part:
The page has some blacklists like loop, while, and, etc. The way we are retrieving data with this payload isn't effective because:
if the file be very large we cannot read it because the has a size limit for the LaTeX code;
if the file don't contain a newline character we cannot read it.
So, reading more techniques about file reading with LaTeX on the previous article from Hacktricks, I discovered the function lstinputlisting, which basically is used to list codes. As we cannot use \begin and \and we must to add a $ at the start and and from our payload.
And we can read all the /etc/passwd file.
So, as we got that form to login on the dev subdomain, the first thing I thought was try to get the password at the .htpasswd located on the subdomain root: /var/www/dev.
Trying to login the machine remotely with SSH with his creds we got a shell sucefully.
Checking the permission in that directory, I saw I has write permission.
Waiting a little bit, verifying with pspy I saw the root executed my reverse shell.
And checking my netcat listener:
At first glance we have a field to submit LaTeX code, intercepting the communication with Burp Suite and trying some payloads from .
And now we got the hash, trying to crack it with , we get the password calculus20 from the user vdaisley.
At my enumerationg, I discovered with the machine is running a cron as the root user executing gnuplot with all the files terminating with .plt located in /opt/gnuplot.
So, searching in the docs how I could make a malicious GNU Plot script to give me a shell, I found explaining how to execute system commands with GNU Plot, so I made a one liner to download my reverse shell and execute it.
