VariaType Walkthrough — <TARGET>

Technical Walkthrough

VariaType Walkthrough — <TARGET>

Current State

The target is fully compromised from the refreshed Pwnbox at <TARGET>. Raw flags are stored only under loot/.

Chain

1. Confirmed 22/tcp SSH and 80/tcp HTTP. The HTTP service redirects to variatype.htb.
2. Added variatype.htb and portal.variatype.htb to Pwnbox hosts resolution.
3. Confirmed the main generator at /tools/variable-font-generator accepts .designspace plus master font uploads.
4. Confirmed portal.variatype.htb/.git/HEAD is exposed, dumped the repository, and recovered the removed portal credential from Git history.
5. Logged into the portal and confirmed generated files are archived under the portal file area.
6. Used <secret redacted> in fontTools.varLib to write a PHP-bearing generated font to /var/www/portal.variatype.htb/public/files/shell-portal-domain-public.php.
7. Verified web command execution as www-data with cmd=id.
8. Read /opt/process_client_submissions.bak, which revealed a Steve-owned FontForge processing pipeline watching /var/www/portal.variatype.htb/public/files.
9. Created steve_payload.tar with an internal filename command injection for <secret redacted>. The payload installed our SSH public key for steve.
10. SSH as steve succeeded. User flag was captured to loot/user.txt.
11. sudo -l as Steve allowed NOPASSWD: /usr/bin/python3 /opt/font-tools/install_validator.py *.
12. Confirmed vulnerable setuptools filename derivation for %2froot%2f.ssh%2fauthorized_keys.
13. Served the root public key from Pwnbox and ran the allowed sudo command to write /root/.ssh/authorized_keys.
14. SSH as root succeeded. Root flag was captured to loot/root.txt.

Key Artifacts

• loot/portal-git-dump/
• exploits/webshell-template.designspace
• enum/shell-portal-domain-public.exec.full.txt
• enum/webshell-processbak.txt
• enum/webshell-stage-steve-tar.txt
• loot/steve_id_ed25519
• enum/steve-post-ssh-enum.txt
• enum/root-setuptools-write.txt
• loot/root_id_ed25519
• loot/user.txt
• loot/root.txt

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Target: VariaType
• Difficulty: Medium, possibly Medium/Hard
• OS: Linux
• Target IP: <TARGET>
• Pwnbox public IP: <TARGET>
• Pwnbox SSH user: profex0r
• Attacker or VPN IP: <TARGET>/23 on tun0
• Local workspace: <local workspace><TARGET>-VariaType
• Remote workspace: /home/profex0r/<TARGET>-VariaType
• Historical non-current workspaces: <local workspace><TARGET>-VariaType and <local workspace><TARGET>-VariaType
• Started local: 2026-05-05 21:19:24 AEST
• Started UTC: 2026-05-05 11:19:24 UTC

Authorization And Context Verification

• Local authorization context was reviewed from scoped Markdown files under <local workspace>
• High-level verification only: written red team authorization exists, the tester role is red team operator or penetration tester, the profile includes github.com/jennofrie, and offensive testing requires written client authorization before commencement.
• Local LightRAG verification completed: the local technical LightRAG instance is healthy and has processed the four scoped Markdown credential files.
• Constraint: treat LightRAG as index verification only for this HTB task, because retrieval can mix in other local red-team documents; direct scoped Markdown remains the source of truth.

Evidence Separation Rule

This workspace is for live evidence from <TARGET> only. Prior results from <TARGET> and <TARGET> are historical only and must not be used as current evidence. Public writeups and prior hypotheses remain advisory until validated against this live target.

Carry-Forward Hypotheses — Do Not Assume

• Possible hostnames or vhosts: variatype.htb, portal.variatype.htb.
• Possible services mentioned publicly: SSH on 22/tcp, HTTP on 80/tcp, HTTPS on 443/tcp inconsistently.
• Possible early web theme: exposed .git, repository recovery, deleted history review.
• Possible application theme: variable-font or font-generation workflow around /tools/variable-font-generator, /files, and download.php.
• Possible exploit themes: fontTools arbitrary file write, FontForge command injection or archive processing, setuptools path traversal or arbitrary file write.
• Validation rule: none of the above counts unless reproduced against <TARGET>.

Evidence Ledger

Synthesis

• The original Pwnbox path used earlier in this workspace was stale or attached to the wrong lane for this VIP+ machine. From that box, the gateway <TARGET> returned Destination Host Unreachable.
• A fresh Pwnbox at <TARGET> on the correct lane reaches the target normally; ICMP succeeds and a minimal SYN scan shows 22/tcp and 80/tcp open while 443/tcp is closed.
• This confirms the earlier blocker was on the attacker-side Pwnbox attachment or routing, not on the target IP itself and not caused by aggressive scanning.
• The live compromise chain is complete:

1. Main generator and portal vhosts validated.

2. Portal /.git leaked a usable portal credential from history.

3. fontTools <secret redacted> wrote a PHP payload into the portal public files path for www-data command execution.

4. Steve's FontForge processing pipeline was abused with <secret redacted> to install an SSH key for steve.

5. Steve's sudo rule for /opt/font-tools/install_validator.py was abused with setuptools <secret redacted> to write /root/.ssh/authorized_keys.

6. Both user and root flags were captured from the live target and stored under loot/.