Attack Scenarios¶
Structured CTF-style challenges for the aipostex lab. Each scenario targets a specific attack surface in the lab environment and provides the exact commands, expected output, and real-world context.
Difficulty Levels¶
| Level | Description |
|---|---|
| Beginner | Single-module, no authentication, direct output |
| Intermediate | Multi-step exploitation, credential extraction, data exfiltration |
| Advanced | Chained attacks across services, credential pivoting, active exploitation |
Scenario Index¶
★ = shown at the DEF CON RTV demo / workshop (the "con path" — start here). The unmarked scenarios are self-serve extra credit across the wider estate.
| # | Scenario | Difficulty | Target | Time |
|---|---|---|---|---|
| 01 | ★ AI Service Reachability Survey | Beginner | All hosts | ~10 min |
| 02 | ★ LLM Gateway Config Extraction | Beginner | ailab-ml:4000 | ~10 min |
| 03 | Inference Server Fingerprinting | Beginner | app TGI gateway + ML TEI | ~15 min |
| 04 | ★ Vector Database PII Extraction | Intermediate | ailab-ml:8000, ailab-ds:6333 | ~20 min |
| 05 | ★ Jupyter Remote Code Execution | Intermediate | ailab-dev:8888, ailab-ds:8889 | ~20 min |
| 06 | ★ ML Platform Credential Harvest | Intermediate | ailab-ml:8265/5000/8444 | ~25 min |
| 07 | RAG Pipeline Poisoning | Intermediate | ailab-ds:8080, ailab-dev:11434 | ~30 min |
| 08 | ★ Credential Chain Exploitation | Advanced | Ray -> MLflow -> HF TGI | ~30 min |
| 09 | ★ ML Pipeline Credential Harvest | Advanced | ailab-ml:9000 | ~30 min |
| 10 | ★ Supply Chain Model Tampering | Advanced | ailab-ml:8265/5000 | ~35 min |
| 11 | ★ MCP Tool Infection | Advanced | ailab-dev:3000 | ~30 min |
| 12 | Multi-Vector Campaign | Advanced | All hosts | ~60 min |
| 13 | ★ Privesc → Model-Weight Theft | Advanced | ailab-dev:11434 → :3000 → root | ~20 min |
| 14 | Bespoke Agent — Fingerprint/Enum/Extract | Intermediate | ailab-app:8110 | ~20 min |
| 15 | Black-box RAG — Citation Recon & Poisoning | Intermediate | ailab-ds:8091 | ~25 min |
| 16 | Detect & Evade — Working Against Real Elastic | Intermediate | ailab-siem:5601 (obs) | ~25 min |
| 17 | Rogue Agents & MCP Privilege Escalation | Advanced | ailab-app:8104, ailab-dev:3002 | ~25 min |
| 18 | Agent Guardrail Triage → Prompt Injection | Intermediate | ailab-app:8110 | ~20 min |
| 19 | Embedding Endpoint Recon | Beginner–Intermediate | ailab-ml:8181 | ~15 min |
| 20 | Behavioral Model Fingerprinting — Masked vs Un-masked | Intermediate | ailab-ml:4000 | ~15 min |
| 21 | Full Agent-Layer Campaign | Advanced | ailab-app:8110, ailab-ds:8091 (obs ailab-siem) | ~40 min |
| 22 | Advanced Prompt-Injection Tradecraft — the Single-Agent Fleet | Intermediate–Advanced | ailab-app:8111–8113 | ~30 min |
Progression Tracks¶
Discovery & Recon → Scenarios 01–03 Start here. Learn aipostex's discovery and fingerprinting modules.
Exploitation → Scenarios 04–07 Extract data, harvest credentials, identify misconfiguration.
Chained Attacks → Scenarios 08–13 Pivot across services using discovered credentials, inject pipelines, run a full campaign, and escalate to root to steal the model itself.
Model & Agent Layer → Scenarios 14–22 Attack the model/agent-conversation layer: bespoke agents, behavioral model fingerprinting, embedding recon, guardrail bypass, black-box RAG, multi-agent A2A, MCP privesc, detect/evade, and a full agent-layer campaign. See the Techniques pages for the transferable methods.
Prerequisites¶
- SSH access to the attack box (ailab-attack / 172.16.50.99)
aipostexbinary installed on the attack box- Lab services running (verify with
bash lab-scripts/verify-lab.sh)