dreadnaught- Machine
- VariaType
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 14 Mar 2026
An exposed .git leaks portal creds and an LFI leaks source; a fonttools designspace writes a webshell, a FontForge cron injection gives SSH, and a setuptools path traversal gives root.
How it went
- 0nmap
nmap shows SSH and nginx serving variatype.htb and a portal vhost.
- 1exposed .git
The portal's exposed .git (with a hidden commit) leaks gitbot creds, and a ....// bypass in download.php reads the Flask font-generator source.
- 2fonttools RCE
The generator calls fonttools varLib; a crafted .designspace (CVE-2025-66034) writes a PHP webshell as www-data.
- 3steve
A ZIP dropped into the shared files dir triggers steve's FontForge cron; a command-injection filename (CVE-2024-25081) plants an SSH key for steve.
- 4setuptools
steve may sudo a validator using setuptools 78.1.0; a %2F-encoded absolute path (CVE-2025-47273) writes a root cron in /etc/cron.d.