search

Topology

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.76.27 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-11 23:49 +08
Nmap scan report for 10.129.76.27
Host is up (0.012s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

HTTP exploits it seems.

hashtag
LaTeX Project -> LFI

The website is seems to be a university website:

There's a LaTeX Equation Generator available. LaTeX is a software made for documentation, and I'm roughly familiar with how it works to make mathematical equations for stuff like university math module notes. Anyways, we have to add latex.topology.htb to our /etc/hosts file to visit the equation.php site available.

On the site itself, it just shows some basic LaTeX syntax:

There are some exploits available pertaining to Latex Injection, such as being able to read machine files. I tried to use \input{/etc/passwd} to read files, but there's a WAF blocking it:

I tested different payloads, and eventually found one that worked on this site:

LogoHacking with LaTeX | 0day.work0day.workchevron-right

Using this, we can get the first line of the /etc/passwd file:

Before carrying on, I wanted to some proper web enumeration to find out what I was supposed to do with this LFI. Using wfuzz, I found a dev subdomain:

This returns a 401, and visiting it requires credentials:

This is a HTTP sign in, meaning we can probably find the credentials in a .htpasswd file somewhere. Also, it coincides with the one-line LFI that we have. However, the same command does not work with the /var/www/dev/.htpasswd file, which is definitely where the password hash is stored.

In this case, what we can do is try to use other commands, like \lstinputlisting. However, this payload doesn't work:

It doesn't work (as I've learnt) because the machine asks for LaTeX inline math mode. There are different modes for LaTeX present, and they would parse characters differently. If we use '$' signs, we can force the machine to process our query by switching mode for it.

LogoWhat are the differences between $...$, $$...$$, \(...\), and \[...\]?TeX - LaTeX Stack Exchangechevron-right

If we use \\lstinputlisting{/var/www/dev/.htpasswd} instead, we see that it processes it as text:

So by using $\lstinputlisting{/var/www/dev/.htpasswd}$, it would be processed as an expression (similar to $() in bash) and loads the hash:

We can crack the hash easily with john:

Then we can access the dev subdomain:

More importantly, we can access the user via ssh:

hashtag
Privilege Escalation

hashtag
GNUPlot

Within the /opt directory, there was a gnuplot file present:

I also ran a pspy64 while searching more about this particular software, and found some interesting processes:

We don't have read access to the directory, but we have write access, meaning we have to manipulate the .plt files present on the /opt directory to somehow achieve RCE as root. Or, we can just add another .plt file.

I found a resource that shows the system keyword can be used to execute system commands:

http://www.bersch.net/gnuplot-doc/system.htmlwww.bersch.netchevron-right

We just need to create a priv.plt file within the directory:

Then, we can just wait for root to execute our new file and privesc that way:

Rooted!

PreviousToolboxNextTraceback

Last updated