Artificial — HTB Writeup | The Hack Sparrow

Executive summary — Artificial is an "AI solutions" machine that lets registered users upload and run Keras models (.h5). That flow is vulnerable to CVE-2024-3660: a Lambda layer can carry an arbitrary Python function that Keras runs while deserializing the model, and the safe_mode protection introduced in recent Keras versions is completely ignored when the model uses the legacy H5 format — exactly the one this app accepts. From the initial RCE, an unsalted-MD5 SQLite database gives SSH access via credential reuse, and the final escalation abuses Backrest (a web UI wrapping restic that runs as root): a malicious backup hook gives arbitrary command execution as root in a single step.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.232.51`

Attack map

[80] "AI Solutions" — Keras .h5 model upload
   │  CVE-2024-3660 — Lambda deserialization RCE (safe_mode ignored in legacy H5)
   ▼
[RCE]  app  (uid 1001)
   │  SQLite DB with MD5 hashes → cracked → gael:mattp005numbertwo
   ▼
[SSH]  gael  (user.txt, sysadm group)
   │  /var/backups/backrest_backup.tar.gz → config.json → base64-wrapped bcrypt
   │  cracked → backrest_root:!@#$%^
   ▼
[API]  Backrest 1.7.2 on 127.0.0.1:9898 (runs as root)
   │  AddRepo + SetConfig (hook on CONDITION_SNAPSHOT_START) + Backup
   ▼
[ROOT]  hook runs as root → SUID bash → root.txt

1. Reconnaissance

The lab didn't offer passwordless sudo to edit /etc/hosts, so work alternated between editing the file directly and using curl --resolve.

echo "10.129.232.51 artificial.htb" | sudo tee -a /etc/hosts
# No-sudo alternative:
curl --resolve artificial.htb:80:10.129.232.51 http://artificial.htb/

nmap -sT -p- --min-rate 3000 -T4 -Pn -oN m2_allports.txt 10.129.232.51

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

nmap -sT -sCV -p22,80 -Pn -oN m2_services.txt 10.129.232.51

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://artificial.htb/

nginx redirects to artificial.htb — virtual hosting is in play.

Resumen ejecutivo — Artificial es una máquina de "soluciones de IA" que permite a usuarios registrados subir y ejecutar modelos Keras (.h5). Ese flujo es vulnerable a CVE-2024-3660: una capa Lambda puede llevar una función Python arbitraria que Keras ejecuta al deserializar el modelo, y la protección safe_mode introducida en versiones recientes de Keras se ignora por completo cuando el modelo usa el formato legacy H5 — precisamente el que acepta esta app. Desde el RCE inicial, una base de datos SQLite con hashes MD5 sin sal da acceso SSH por reutilización de credenciales, y la escalada final abusa de Backrest (una interfaz web sobre restic que corre como root): un hook de backup malicioso da ejecución de comandos arbitraria como root en un solo paso.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.232.51`

Mapa del ataque

[80] "AI Solutions" — subida de modelos Keras .h5
   │  CVE-2024-3660 — Lambda deserialization RCE (safe_mode ignorado en H5 legacy)
   ▼
[RCE]  app  (uid 1001)
   │  BD SQLite con hashes MD5 → crackeados → gael:mattp005numbertwo
   ▼
[SSH]  gael  (user.txt, grupo sysadm)
   │  /var/backups/backrest_backup.tar.gz → config.json → bcrypt en base64
   │  crackeado → backrest_root:!@#$%^
   ▼
[API]  Backrest 1.7.2 en 127.0.0.1:9898 (corre como root)
   │  AddRepo + SetConfig (hook en CONDITION_SNAPSHOT_START) + Backup
   ▼
[ROOT]  hook ejecutado como root → bash SUID → root.txt

1. Reconocimiento

El laboratorio no ofrecía sudo sin contraseña para editar /etc/hosts, así que se trabajó alternando entre editar el fichero puntualmente y usar curl --resolve.

echo "10.129.232.51 artificial.htb" | sudo tee -a /etc/hosts
# Alternativa sin sudo:
curl --resolve artificial.htb:80:10.129.232.51 http://artificial.htb/

nmap -sT -p- --min-rate 3000 -T4 -Pn -oN m2_allports.txt 10.129.232.51

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

nmap -sT -sCV -p22,80 -Pn -oN m2_services.txt 10.129.232.51

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://artificial.htb/

nginx redirige a artificial.htb — hay virtual hosting.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.