Hack The Box - HTB SmartHire Writeup - Medium- Weekly - May 16th, 2026

May 21, 2026

SmartHire — Walkthrough Machine Detail Value Name SmartHire Difficulty Medium OS Linux Date 05-16-2026 Introduction SmartHire is a Linux-based target that demonstrates the risks of outdated MLOps infrastructure and insecure plugin architectures. The attack vector involves bypassing authentication on an outdated MLflow instance (version 2.14.1), achieving Remote Code Execution (RCE) via a tailored Pickle deserialization payload, and escalating privileges through a writable Python plugin directory used by a high-privilege management script. Phase 1: Reconnaissance and Enumeration Nmap Por…