HackTheBox Writeup - SmartHire

Target IP: 10.129.245.215 Difficulty: Medium OS: Linux

1. Reconnaissance

Nmap Scan

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://smarthire.htb/

Subdomain Discovery

Adding smarthire.htb to /etc/hosts and further enumeration/research reveals the subdomain models.smarthire.htb. This subdomain hosts an MLflow instance (v2.14.1), which is accessible using common credentials admin:password.

2. Initial Access (Foothold)

Vulnerability: CVE-2024-37054 (Insecure Pickle Deserialization)

MLflow version 2.14.1 is vulnerable to insecure deserialization in its pyfunc model flavor.

Exploitation Steps:

1. Create a Run: Create a new experiment run via the MLflow API to get a run_id.
2. Generate Malicious Pickle: Craft a python_model.pkl that executes a reverse shell (or command) using the __reduce__ method.
3. Upload Artifacts: Upload the malicious python_model.pkl and a descriptor MLmodel file to the run’s artifact directory.
4. Register Model: Register the poisoned run as a new model version for the user’s company-specific model name (found via the /model_info endpoint on the main dashboard).
5. Trigger: Use the “Make Predictions” feature on smarthire.htb/predict. When the application loads the registered model version, the pickle is deserialized, executing the payload.

User Flag: e050f6c4315dfface834893b3af85b65

3. Privilege Escalation

Vulnerability: Python Module Hijacking

Checking sudo -l for the svcweb user:

(root) NOPASSWD: /usr/bin/python3.10 /opt/tools/mlflow_ctl/mlflowctl.py *

The script /opt/tools/mlflow_ctl/mlflowctl.py uses site.addsitedir() on the /opt/tools/mlflow_ctl/plugins/ directory.

Exploitation Steps:

1. Check Permissions: The svcweb user is in the devs group, which has write access to /opt/tools/mlflow_ctl/plugins/dev/.
2. Hijack Path: Create a .pth file (e.g., exploit.pth) in the dev plugin directory. Python executes code inside .pth files during path initialization.
3. Execute Sudo: Run the allowed sudo command:

   sudo /usr/bin/python3.10 /opt/tools/mlflow_ctl/mlflowctl.py status
   

4. Root Access: The malicious code in the .pth file runs as root.

Root Flag: c4b5a954abfe4718f345a18e22459dc8