Payload — TryHackMe
Payload — TryHackMe
Category: AI Security
Difficulty: Easy
Warning: Full solution ahead. Try the room yourself first!
Scenario
A SOC alert fired at 03:14 with no scheduled deployments and no logged changes. The ML inference server was making outbound HTTPS connections to an unrecognised address.
You’ve been called in to investigate. All incident materials are at /opt/supply-chain/incident/. That’s your working directory for this entire investigation.
The directory contains:
logs/— deployment and network logsmodels/— the production model currently running and a staged candidate replacement- A clean baseline model for comparison
The investigation follows a natural order: start with the logs to build a timeline, then examine the production model, then assess the candidate replacement before it gets deployed.
Reading the Deployment Log
cat /opt/supply-chain/incident/logs/deployment.log
Two things jump out from the output.
Q1 — What organisation did the replacement model come from?
The log contains this line:
New source organisation detected: trustworthy-ai-labAnswer: trustworthy-ai-lab
Q2 — How many days passed between deployment and the SOC alert?
Two timestamps are relevant:
[2024-01-26 14:32:16] INFO Model deployed to production inference server
[2024-02-16 03:14:00] ALERT SOC automated alert: unusual outbound HTTPS traffic detectedThe model was deployed on January 26. The alert fired on February 16. Counting the days: 5 remaining days in January plus 16 days in February gives us:
Answer: 21 days
Decompiling the Production Model
Navigate into the models directory and run fickling against the production model:
cd /opt/supply-chain/incident/models
fickling production_model.pklFickling is a tool for analysing Python pickle files. Pickle files are commonly used to serialise ML models but they’re dangerous because they can execute arbitrary code when loaded. This is exactly what happened here.
Q3 — What Python function does the payload use to execute the shell command?
Get Monas’s stories in your inbox
Join Medium for free to get updates from this writer.
The decompiled output clearly shows the system function being used to run shell commands.
Answer: system
Q4 — What shell command does the payload use to capture the host’s identity?
Looking at what the system function is actually running, the payload calls hostname to identify the machine it has landed on.
Answer: hostname
Checking the Beacon Capture Log
Q5 — The beacon capture log shows the HTTP method used in the outbound request. What is it?
cat /opt/supply-chain/incident/logs/beacon_capture.log
This log captured the outbound request that triggered the SOC alert. Reading through it reveals the HTTP method used in the request.
Answer: POST
Take note of the first part of the flag visible in this log — you’ll need it for the final question.
Q6 — Inspecting the Candidate Replacement Model
The engineering team staged an .h5 model as a replacement but haven’t deployed it yet. Run the provided inspection script against it:
python3 /opt/supply-chain/tools/inspect_h5_model.py candidate_model.h5
The output flags a layer that requires review:
lambda (manipulate_output)This is a Lambda layer — a custom layer in a Keras/TensorFlow model that can execute arbitrary Python code. The name alone is a red flag. This candidate model is also compromised and should not be deployed.
Answer: manipulate_output
The output also contains the second part of the flag. Note it down.
Q7 — Recovering the Full Campaign Flag
The attacker split the campaign ID across two artefacts to avoid full exposure in any single capture. You already have both pieces:
- Part 1 — found in
beacon_capture.log - Part 2 — found in the
inspect_h5_model.pyoutput
Combine them in order and submit the complete flag.
What This Room Teaches You
ML supply chain attacks are a growing real-world threat. Attackers don’t need to break into your infrastructure directly — they can compromise the model itself before it ever reaches you. This room demonstrates two common techniques: poisoning a pickle file with arbitrary code that executes on load, and hiding malicious logic inside a custom Lambda layer in a neural network. Both are subtle enough to slip past reviews that only check model accuracy rather than model integrity. Always verify the source of your models and inspect them before deployment.
— monasx0
Contact: monasnaveedsec@gmail.com
