Introduction

This writeup details the exploitation of the "Artificial" machine from Hack The Box,
which showcases interesting vectors involving AI model manipulation and service
exploitation.

Initial Enumeration

First, let's start with a comprehensive port scan using RustScan to identify
available services:

 .----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
 |   |   | __ {_   _}{ {__  /  ___} / {} \ |  `| |
 | .-. \| _ |.-._} } | |  .-._} }\     }/  /\  \| |\  |
 `-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
 The Modern Day Port Scanner.
 ________________________________________
 : http://discord.skerritt.blog         :
 : https://github.com/RustScan/RustScan :-------------------------------------
  The config file is expected to be at "/root/.rustscan.toml"
  Automatically increasing ulimit value to 10000.
 ! File limit is lower than default batch size. Consider upping with --ulimit. Ma
 y cause harm to sensitive servers
 Open 10.10.xx.xx:22
 Open 10.10.xx.xx:80
  Starting Script(s)
  Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} A Pn" on ip 1
 0.10.xx.xx
 Depending on the complexity of the script, results may take some time to app
 ear.
[~] Starting Nmap 7.95  https://nmap.org ) at 2025-06-22 14:34 +08
 NSE Loaded 157 scripts for scanning.
 NSE Script Pre-scanning.
 NSE Starting runlevel 1 (of 3 scan.
 Initiating NSE at 1434
 Completed NSE at 1434, 0.00s elapsed
 NSE Starting runlevel 2 (of 3 scan.
 Initiating NSE at 1434
 Completed NSE at 1434, 0.00s elapsed
 NSE Starting runlevel 3 (of 3 scan.
 Initiating NSE at 1434
 Completed NSE at 1434, 0.00s elapsed
 Initiating SYN Stealth Scan at 1434
 Scanning artificial.htb 10.10.xx.xx) [2 ports]
 Discovered open port 22/tcp on 10.10.xx.xx
 Discovered open port 80/tcp on 10.10.xx.xx
 Completed SYN Stealth Scan at 1434, 0.18s elapsed 2 total ports)
 Initiating Service scan at 1434
 Scanning 2 services on artificial.htb 10.10.xx.xx)
 Completed Service scan at 1434, 6.23s elapsed 2 services on 1 host)
 Initiating OS detection (try #1 against artificial.htb 10.10.xx.xx)
 Initiating Traceroute at 1434
 Completed Traceroute at 1434, 0.17s elapsed
 Initiating Parallel DNS resolution of 1 host. at 1434
 Completed Parallel DNS resolution of 1 host. at 1434, 0.01s elapsed
 DNS resolution of 1 IPs took 0.01s. Mode: Async [# 1, OK 0, NX 1, DR 0, SF 
0, TR 1, CN 0
 NSE Script scanning 10.10.xx.xx.
 NSE Starting runlevel 1 (of 3 scan.
 Initiating NSE at 1434
 Completed NSE at 1434, 4.89s elapsed
 NSE Starting runlevel 2 (of 3 scan.
 Initiating NSE at 1434
 Completed NSE at 1434, 0.57s elapsed
 NSE Starting runlevel 3 (of 3 scan.
 Initiating NSE at 1434
Completed NSE at 1434, 0.00s elapsed
 Nmap scan report for artificial.htb 10.10.xx.xx)
 Host is up, received user-set 0.13s latency).
 Scanned at 20250622 143415 08 for 14s
 PORT   STATE SERVICE REASON         VERSION
 22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 Ubunt
 u Linux; protocol 2.0
 | ssh-hostkey:
 |   3072 7c:e48d:84:c5:de:913a:5a:2b:9d:34:ed:d69917 RSA
 | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNABz8gRtjOqG4+jUCJb2
 NFlaw1auQlaXe1/IBhqrriREBnu476PNw6mFG9ifT57WWE/qvAZQFYRvPupR
 eMJD4C3bE3fSLbXAoP037JrZkNmPRpVetRjUwP1acu7golA8MnPGzGa2UW
 38oK/TnkJDlZgRpQq/7DswCr38IPxvHNO/15iizgOETTTEU8pMtUm/ISNQfPcG
 LGc0x5hWxCPbu75OOOsPt2vA2qD4/sb9bDCOR57bAt4i+WEqp7Ri/act+f4k6v
 ypm1sebNXeYaKapw+W83en2LnJOU0lsdhJiAPKaD/srZRZKOR0bsPcKOqLWQ
 R/A6Yy3iRE8fcKXzfbhYbLUiXZzuUJoEMW33l8uHuAza57PdiMFnKqLQ6LBfw
 Ys64Q3v8oAn5O7upCI/nDQ6raclTSigAKpPbliaL0HE/P7UhNacrGE7Gsk/FwADi
 XgEAseTn609wBnLzXyhLzLb4UVu9yFRWITkYQ6vq4ZqsiEnAsur/jt8WZY6MQ
 8
 |   256 83462d:cf:736d:286f:11:d51d:b48820:d67c ECDSA
 | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdH
 AyNTYAAABBBOdlb8oU9PsHX8FEPY7DijTkQzsjeFKFf/xgsEav4qedwBUFzOet
 bfQNn3ZrQ9PMIHrguBG+cXlA2gtzK4NPohU
 |   256 e3182e:3b:4061:b45987:e84a:29240f:6a:fc ED25519
 |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8QL1LMgQkZcpxuylBjhjosiCx
 cStKt8xOBU0TjCNmD
 80/tcp open  http    syn-ack ttl 63 nginx 1.18.0 Ubuntu)
 | http-methods:
 |_  Supported Methods: HEAD OPTIONS GET
 |_http-title: Artificial  AI Solutions
 |_http-server-header: nginx/1.18.0 Ubuntu)
 Warning: OSScan results may be unreliable because we could not find at least 
1 open and 1 closed port
 Device type: general purpose
 Running: Linux 4.X|5.X
OS CPE cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
 OS details: Linux 4.15  5.19
 TCP/IP fingerprint:
 OSSCANV7.95%E4%D6/22%OT22%CT%CU40924%PVY%DS
 2%DCT%GN%TM6857A3F5
 OS%P=x86_64-pc-linux-gnu)SEQ(SPFE%GCD1%ISR107%TIZ%CIZ%II
 =I%TSAOPSO
 OS1M542ST11NW7%O2M542ST11NW7%O3M542NNT11NW7%O4M54
 2ST11NW7%O5M542ST11N
 OSW7%O6M542ST11WINW1FE88%W2FE88%W3FE88%W4FE88%
 W5FE88%W6FE88ECNR
 OSY%DFY%T40%WFAF0%OM542NNSNW7%CCY%QT1RY%DF
 Y%T40%SO%AS%FAS%
 OSRD0%QT2RNT3RNT4RY%DFY%T40%W0%SA%AZ%F
 =R%O%RD0%QT5RY
 OS%DFY%T40%W0%SZ%AS%FAR%O%RD0%QT6RY%DF
 Y%T40%W0%SA%AZ%FR
 OS%O%RD0%QT7RY%DFY%T40%W0%SZ%AS%FAR%O
 =%RD0%QU1RY%DFN%T
 OS40%IPL164%UN0%RIPLG%RIDG%RIPCKG%RUCKG%RUDGIE
 (RY%DFIN%T40%CDS
 OS
 Uptime guess: 19.549 days (since Tue Jun  3 012417 2025
 Network Distance: 2 hops
 TCP Sequence Prediction: Difficulty=254 Good luck!
 IP ID Sequence Generation: All zeros
 Service Info: OS Linux; CPE cpe:/o:linux:linux_kernel
 TRACEROUTE (using port 22/tcp)
 HOP RTT       ADDRESS
 1   165.32 ms 10.10.16.1
 2   79.75 ms  artificial.htb 10.10.xx.xx)
 NSE Script Post-scanning.
 NSE Starting runlevel 1 (of 3 scan.
Initiating NSE at 1434
 Completed NSE at 1434, 0.00s elapsed
 NSE Starting runlevel 2 (of 3 scan.
 Initiating NSE at 1434
 Completed NSE at 1434, 0.00s elapsed
 NSE Starting runlevel 3 (of 3 scan.
 Initiating NSE at 1434
 Completed NSE at 1434, 0.00s elapsed
 Read data files from: /usr/share/nmap
 OS and Service detection performed. Please report any incorrect results at htt
 ps://nmap.org/submit/ .
 Nmap done: 1 IP address 1 host up) scanned in 14.47 seconds
 Raw packets sent: 34 2.306KB | Rcvd: 22 3.270KB
 ┌──(root
kali)-[~]
 └─# echo "10.10.xx.xx artificial.htb" | tee -a /etc/hosts10.10.xx.xx artificial.htb

Web Application Exploration

After adding the hostname to our
/etc/hosts file, we can access the web application.
Upon initial inspection, we discover a registration functionality that allows new
users to create accounts.

An image to describe post

Once that lets login and here we have a file upload functionality.

An image to describe post

An image to describe post

An image to describe post

Initial Foothold: TensorFlow Model Exploitation

After analyzing the application's functionality, I discovered it accepts model
uploads. This presented an interesting attack vector through TensorFlow model
manipulation. Based on research from
TensorFlow Remote Code Execution with Malicious Model, I crafted the following exploit: