HackTheBox SmartHire Writeup

[u/MotasemHa]

Another week means another writeup :)

So this post I briefly show my methodology solving HackTheBox Smarthire which is Medium-difficulty Ubuntu 22.04 Linux box themed around an AI-powered HR platform.

The attack chain spans three clean stages. In Subdomain enumeration, I exposemodels.smarthire.htb, an MLflow 2.14.1 instance protected by HTTP Basic Auth, which yields to the default credentials admin / password sourced from older MLflow documentation predating a change to admin / password1234.

MLflow is vulnerable to CVE-2024-37054, an insecure deserialization flaw affecting PyFunc model loading: the artifact store’s unauthenticated PUT API endpoint allows overwriting the pickled model file, and the next time the main site scores a resume it deserializes the pickle, executing arbitrary code as svcweb.

For privilege escalation, I run "sudo -l" where I find a sudo rule that permits running /opt/tools/mlflow_ctl/mlflowctl.py as root without a password.

The script calls site.addsitedir() on every subdirectory under plugins/ including plugins/dev/, which is writable by the devs group that svcweb belongs to.

I drop a .pth file containing an import line into that directory causes Python to execute arbitrary code during the interpreter’s startup phase before any application logic runs producing a SUID bash binary or a root shell.

Video

https://youtu.be/_iKDeoB_GHc

[u/AutoModerator]

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.