Topology

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Topology (Ubuntu, attack surface: Apache httpd 2.4.41 ((Ubuntu)) (80), OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) (22)). Foothold via command injection, ssti; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.217 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sVC 10.10.11.217 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.217 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-10-01 06:44 PDT
Nmap scan report for toplogy.htb (10.10.11.217)
Host is up (0.028s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 dcbc3286e8e8457810bc2b5dbf0f55c6 (RSA)
|   256 d9f339692c6c27f1a92d506ca79f1c33 (ECDSA)
|_  256 4ca65075d0934f9c4a1b890a7a2708d7 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Miskatonic University | Topology Group
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 23.15 seconds

1. Based from the nmap results, the machine runs a web application and opens ssh login.

2. After ran dirsearch found nothing interesting.

3. Checking the webpage, found an interesting link.

4. Interesting, I think we all have the same thought here of what the vuln might be.

5. It could be command injection or SSTI.

6. Anyway, after searching on the internet about latex injection found this --> https://book.hacktricks.xyz/pentesting-web/formula-doc-latex-injection.

7. Let's try to read a file using these template payloads.

Input --> $\lstinputlisting{/etc/passwd}$

1. It creates a .png file and shows what's inside passwd. Great! This is our foothold, noticed we found 2 users --> root and vdaisley.

2. Anyway, I think the intended way is to get a reverse shell using command injection payload for LaTeX. But since it allows us to do arbitrary files read.

3. Hence, I tried to traverse all common dir and files location, but somehow can't access them.

4. Stuck in this for a while, until I check for subdomains and found this:

5. Found a subdomain --> dev.

dev.topology.htb

1. Interesting! Let's run dirsearch again for this subdomain.

2. As you can see, I think it will shows the same result as the topology.htb domain.

3. But the unique thing is, there is no such ".htpasswd" inside it but indeed there seems ".htpasswds".

4. Even accessing ".htpasswds" shall gave me error message. Trying access ".htpasswd" shows us cred for vdaisley user.

5. Awesome, let's crack it with john.

6. Let's login to ssh as vdaisley:calculus20.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. LaTex Injection.
2. Using FFUF.
3. htpasswds.