Topology

https://app.hackthebox.com/machines/Topology

Nmap scan

Directory scan

  • Bruteforcing wasn't much helpful for this machine

  • Found a subdomain on the src code of homepage

  • subdomani : latex.topology.htb

  • URL that was given : http://latex.topology.htb/equation.php

Subdomain scan

  • domains we found : stats , dev and latex.

  • the stats domain had statistics for the website, dev had a username and password for login

User shell

  • The intesting domain was latex

Just a page which converts latex to image

  • We'll need to do latex injection attack.

LogoFormula/CSV/Doc/LaTeX/GhostScript Injection - HackTricksbook.hacktricks.xyz
There's list of payloads we can spray

  • We can't get RCE since all things were blacklisted but, there was one payload working where we can read files

  • Payload : \lstinputlisting{/usr/share/texmf/web2c/texmf.cnf}

  • Final Payload : $\lstinputlisting{/etc/passwd}$

Ssh vdaisley

  • we can't get the RCE, but reading files is also important

  • I tried with getting ssh keys, but found out there were no keys in vdaisley's directory

  • After a while, i thought to get password for dev.topology.htb

  • On google search I found out .htpasswd is where Apache server stores the password.

  • GET PASSWORD FOR dev subdomain : $\lstinputlisting{/var/www/dev/.htpasswd}$

  • foudn the hash 🎉

  • I used john to crack the hash

  • BOOOM DONEEEEEEE, we are now user.

Root shell

  • First i looked files that belongs to user <snipped>

  • Then i tried with finding sudo bits

  • Nothing was helpful so i checked /opt and found intresting folder

  • We dont have read access on this BUT we do have write access to it.

  • I ran pspy64 tool in the box

  • So there's a cronjob which runs with root privileges, it runs all the files that ends with .plt

  • Since we have write access to /opt/gnuplot we can write malicious code & wait for the cronjob to finish things for us.

AND DONE WE ARE ROOOOOOOOT

....................heapbytes's still pwning things.

PreviousBrokerNextHorizontall

Last updated