Topology
Last updated
Last updated
Nmap scan:
HTTP exploits it seems.
The website is seems to be a university website:
There's a LaTeX Equation Generator available. LaTeX is a software made for documentation, and I'm roughly familiar with how it works to make mathematical equations for stuff like university math module notes. Anyways, we have to add latex.topology.htb to our /etc/hosts file to visit the equation.php site available.
On the site itself, it just shows some basic LaTeX syntax:
There are some exploits available pertaining to Latex Injection, such as being able to read machine files. I tried to use \input{/etc/passwd} to read files, but there's a WAF blocking it:
I tested different payloads, and eventually found one that worked on this site:
Using this, we can get the first line of the /etc/passwd file:
Before carrying on, I wanted to some proper web enumeration to find out what I was supposed to do with this LFI. Using wfuzz, I found a dev subdomain:
This returns a 401, and visiting it requires credentials:
This is a HTTP sign in, meaning we can probably find the credentials in a .htpasswd file somewhere. Also, it coincides with the one-line LFI that we have. However, the same command does not work with the /var/www/dev/.htpasswd file, which is definitely where the password hash is stored.
In this case, what we can do is try to use other commands, like \lstinputlisting. However, this payload doesn't work:
It doesn't work (as I've learnt) because the machine asks for LaTeX inline math mode. There are different modes for LaTeX present, and they would parse characters differently. If we use '$' signs, we can force the machine to process our query by switching mode for it.
If we use \\lstinputlisting{/var/www/dev/.htpasswd} instead, we see that it processes it as text:
So by using $\lstinputlisting{/var/www/dev/.htpasswd}$, it would be processed as an expression (similar to $() in bash) and loads the hash:
We can crack the hash easily with john:
Then we can access the dev subdomain:
More importantly, we can access the user via ssh:
Within the /opt directory, there was a gnuplot file present:
I also ran a pspy64 while searching more about this particular software, and found some interesting processes:
We don't have read access to the directory, but we have write access, meaning we have to manipulate the .plt files present on the /opt directory to somehow achieve RCE as root. Or, we can just add another .plt file.
I found a resource that shows the system keyword can be used to execute system commands:
We just need to create a priv.plt file within the directory:
Then, we can just wait for root to execute our new file and privesc that way:
Rooted!
