https://blog.mauzy.net/tags/backrest/ Recent content in Backrest on Hugo en-us Tue, 01 Jul 2025 07:07:07 +0100 https://blog.mauzy.net/puzzles/artificial/ Tue, 01 Jul 2025 07:07:07 +0100 https://blog.mauzy.net/puzzles/artificial/ <h1 id="enum">Enum</h1> <h2 id="nmap">NMAP</h2> <pre tabindex="0"><code>PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 7c:e4:8d:84:c5:de:91:3a:5a:2b:9d:34:ed:d6:99:17 (RSA) | 256 83:46:2d:cf:73:6d:28:6f:11:d5:1d:b4:88:20:d6:7c (ECDSA) |_ 256 e3:18:2e:3b:40:61:b4:59:87:e8:4a:29:24:0f:6a:fc (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Artificial - AI Solutions |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel </code></pre><h2 id="dirsearch">Dirsearch</h2> <pre tabindex="0"><code>Target: http://artificial.htb/ [22:13:55] Starting: [22:14:25] 302 - 199B - /dashboard -&gt; /login [22:14:36] 200 - 857B - /login [22:14:37] 302 - 189B - /logout -&gt; / [22:14:49] 200 - 952B - /register </code></pre><h2 id="shell-using-tensorflow-vulnerability">Shell using tensorflow vulnerability</h2> <ul> <li>Setup Docker Image</li> <li>Install Vim, remove export and build the image</li> <li>Run the python code to create our exploit</li> <li>Upload the .h5 file through the file upload</li> </ul> <h2 id="shell-popped">Shell popped</h2> <p>We can see app.py in the home directory</p>