VariaType hosts a pair of websites for a font foundry, a Flask-based font generator and a PHP validation portal. I’ll recover the portal’s source from an exposed Git repository to get credentials, and then abuse a single-pass filter bypass in its download feature to read files off the host. With the Flask application’s source in hand, I’ll exploit an arbitrary file write in fontTools’ variable font generation to drop a PHP webshell and get a foothold. A cron job validates uploaded fonts with an outdated FontForge build, which I’ll exploit through command injection in a malicious archive’s filenames to pivot to the next user. Finally, I’ll abuse a sudo-allowed plugin installer that downloads files with a vulnerable version of setuptools, using a path traversal in its PackageIndex to write an SSH key to root’s home directory.

0xdf hacks stuff

A detailed walkthrough of the HackTheBox machine 'VariaType', which hosts a Flask-based font generator and a PHP validation portal. The attack chain involves: recovering portal source code from an exposed .git repository to obtain credentials; exploiting a single-pass filter bypass (....// pattern) in a PHP download endpoint for arbitrary file read; leveraging CVE-2025-66034 (arbitrary file write in fontTools varLib) to drop a PHP webshell into the portal's web root; exploiting command injection via malicious archive filenames in an outdated FontForge build triggered by a cron job to pivot users; and finally abusing a sudo-allowed plugin installer using a vulnerable setuptools version with a PackageIndex path traversal to write an SSH key to root's home directory.

HTB: VariaType