SmartHire

Technical Walkthrough

SmartHire — Walkthrough

Status: COMPLETE. Raw flags and reusable secrets are stored only in <local workspace><TARGET>-SmartHire/loot/.

Chain

1. Recon found only SSH and HTTP. HTTP redirected to smarthire.htb; vhost fuzzing discovered models.smarthire.htb.
2. models.smarthire.htb exposed MLflow 2.14.1 behind Basic Auth. A default credential succeeded; value stored in loot/mlflow-basic-auth.json.
3. The SmartHire app allowed normal registration/login and exposed /dashboard, /model_info, /upload_hiring_data, and /predict.
4. /model_info revealed an app-derived MLflow registered model name. Authenticated MLflow API access allowed registering model versions under that name.
5. A benign model registration proved SmartHire consumed the MLflow registry. A callback model proved command execution as svcweb when /predict loaded the registered model.
6. A reverse-shell model gave a shell as svcweb; user.txt was captured to loot/user.txt.
7. sudo -l showed svcweb could run /usr/bin/python3.10 /opt/tools/mlflow_ctl/mlflowctl.py * as root.
8. The script imports plugin directories with site.addsitedir(). /opt/tools/mlflow_ctl/plugins/dev was group-writable by devs, and svcweb belonged to devs.
9. A temporary .pth hook in the dev plugin directory executed as root via the allowed sudo command, copied root proof/flag to /tmp, and was removed immediately.
10. root.txt was captured to loot/root.txt; MLflow model versions and the temporary .pth hook were cleaned up.

Key Evidence

• Nmap: <local workspace><TARGET>-SmartHire/nmap/initial, <local workspace><TARGET>-SmartHire/nmap/allports
• Vhost discovery: <local workspace><TARGET>-SmartHire/enum/ffuf-vhosts-filtered.json
• MLflow version/API: <local workspace><TARGET>-SmartHire/enum/mlflow-api-summary.json
• App endpoints: <local workspace><TARGET>-SmartHire/enum/auth-js-endpoints.json
• Callback proof: <local workspace><TARGET>-SmartHire/enum/proof-callback-review.txt
• Foothold shell log: <local workspace><TARGET>-SmartHire/enum/tmux-shell.log
• Sudo/privesc script inspection: <local workspace><TARGET>-SmartHire/enum/mlflowctl-inspect.txt
• Root proof and cleanup evidence: <local workspace><TARGET>-SmartHire/enum/root-privesc-exec.txt, <local workspace><TARGET>-SmartHire/enum/mlflow-cleanup-summary.json

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Target: SmartHire

Active IP: <TARGET>

Prior IP(s): <TARGET> (stale; prior target state showed filtered ports only)

Difficulty: Medium

OS: Linux

Created by: retrib3

Pwnbox: <TARGET> (profex0r), hostname htb-pbtmg2qrop

Attacker/VPN IP: <TARGET>

Workspace Local: <local workspace><TARGET>-SmartHire

Workspace Pwnbox: /home/profex0r/<TARGET>-SmartHire

Started: 2026-05-27

Completion State: COMPLETE

Evidence Ledger

LightRAG Checkpoints

Findings

• TCP: only 22/tcp OpenSSH and 80/tcp nginx exposed.
• HTTP redirects bare IP to smarthire.htb.
• Vhost fuzzing found models.smarthire.htb, an MLflow service behind Basic Auth.
• SmartHire app supports normal user registration and uses app-derived MLflow registered model names.
• MLflow default credential worked and allowed model registry writes.
• SmartHire /predict loads the latest MLflow model for the account/company model name, enabling model-load code execution.
• Foothold user: svcweb; groups include mlflowweb and devs.
• Privilege escalation: sudo-allowed Python script adds group-writable plugin directory to site, allowing temporary .pth execution as root.

Phase 2 Research

• Research file: enum/research-mlflow-websearch.txt (advisory; deleted/recreated only if needed, not required for proof).
• MLflow Basic Auth/default credential risk was validated live by successful authenticated access.
• MLflow model artifact/deserialization and model registry abuse classes were treated as advisory until live validation proved the app consumed a registered model and loaded it during prediction.
• The .pth privesc vector was verified directly from the sudo script and filesystem permissions, not external research.

Phase 3 Synthesis / Ranked Hypotheses

Completion State

COMPLETE

Memory Summary

Platform: HackTheBox machine

Type: Linux Medium

Status: solved from live target

Reusable Lessons

• Vhost fuzzing on a simple nginx/Flask app found an MLflow service behind Basic Auth on a subdomain.
• MLflow default/auth weakness plus SmartHire's app-specific registered model lookup formed the foothold chain.
• Before exploit, validate model-registry consumption with /model_info and a benign model/callback; do not trust public MLflow CVE claims until the app actually loads the model.
• MLflow pyfunc/model-load deserialization can execute before prediction fully succeeds, so an application error after model load can still mean command execution occurred.
• For privesc, a sudo-allowed Python script that uses site.addsitedir() on group-writable plugin directories is exploitable via temporary .pth code execution.

Evidence Workspace

<local workspace><TARGET>-SmartHire

No raw flags or reusable credentials are included here. Ingest only after user approval.

Session Resume

Completion state: COMPLETE

Access

• Foothold obtained as svcweb through SmartHire MLflow model-load execution.
• Root execution proven through temporary .pth plugin hook via allowed sudo command.
• User flag: loot/user.txt
• Root flag: loot/root.txt

Cleanup

• Temporary MLflow registered model versions removed. Evidence: enum/mlflow-cleanup-summary.json.
• Temporary sudo .pth hook removed. Evidence: enum/root-privesc-exec.txt.
• Active tmux/listeners stopped at end of session.

Active Sessions/Tunnels/Tickets

None expected after cleanup.

If resuming

1. Verify target IP and /etc/hosts if machine respawned.
2. Recreate a normal app account and MLflow default credential proof if needed.
3. Use notes/walkthrough evidence to reproduce; do not rely on stale model registry objects because cleanup removed them.

Notes

Target: SmartHire

Active IP: <TARGET>

Prior IP(s): <TARGET> (stale; prior target state showed filtered ports only)

Difficulty: Medium

OS: Linux

Created by: retrib3

Pwnbox: <TARGET> (<<secret redacted>>), hostname htb-pbtmg2qrop

Attacker/VPN IP: <TARGET>

Workspace Local: <local workspace><TARGET>-SmartHire

Workspace Pwnbox: /home/<<secret redacted>>/<TARGET>-SmartHire

Started: 2026-05-27

Completion State: COMPLETE

Operating Notes

• Source of truth is live target <TARGET>.
• Older workspace <local workspace><TARGET>-SmartHire is advisory stale state only.
• Raw flags, credentials, tokens, and reusable secrets stay in loot/ only and are referenced by path.
• Medium flow completed: baseline recon, mandatory research, synthesis, foothold, privesc, cleanup.

Evidence Ledger

LightRAG Checkpoints

Findings

• TCP: only 22/tcp OpenSSH and 80/tcp nginx exposed.
• HTTP redirects bare IP to smarthire.htb.
• Vhost fuzzing found models.smarthire.htb, an MLflow service behind Basic Auth.
• SmartHire app supports normal user registration and uses app-derived MLflow registered model names.
• MLflow default credential worked and allowed model registry writes.
• SmartHire /predict loads the latest MLflow model for the account/company model name, enabling model-load code execution.
• Foothold user: svcweb; groups include mlflowweb and devs.
• Privilege escalation: sudo-allowed Python script adds group-writable plugin directory to site, allowing temporary .pth execution as root.

Phase 2 Research

• Research file: enum/research-mlflow-websearch.txt (advisory; deleted/recreated only if needed, not required for proof).
• MLflow Basic Auth/default credential risk was validated live by successful authenticated access.
• MLflow model artifact/deserialization and model registry abuse classes were treated as advisory until live validation proved the app consumed a registered model and loaded it during prediction.
• The .pth privesc vector was verified directly from the sudo script and filesystem permissions, not external research.

Phase 3 Synthesis / Ranked Hypotheses

Completion State

COMPLETE

Session Resume

Completion state: COMPLETE

Access

• Foothold obtained as svcweb through SmartHire MLflow model-load execution.
• Root execution proven through temporary .pth plugin hook via allowed sudo command.
• User flag: <REDACTED>
• Root flag: <REDACTED>

Cleanup

• Temporary MLflow registered model versions removed. Evidence: enum/mlflow-cleanup-summary.json.
• Temporary sudo .pth hook removed. Evidence: enum/root-privesc-exec.txt.
• Active tmux/listeners stopped at end of session.

Active Sessions/Tunnels/Tickets

None expected after cleanup.

If resuming

1. Verify target IP and /etc/hosts if machine respawned.
2. Recreate a normal app account and MLflow default credential proof if needed.
3. Use notes/walkthrough evidence to reproduce; do not rely on stale model registry objects because cleanup removed them.

Notes

Target: SmartHire

IP: <TARGET>

Difficulty: Medium

OS: Linux

Pwnbox: <TARGET> (<<secret redacted>>)

VPN/Attacker IP: <TARGET>

Started: 2026-05-25

Completion State: <secret redacted>

Evidence Ledger

Findings

(Pending target availability)