Skip to main content
El Hacker Ético

How to deploy and hack a boot2root machine

This guide covers how to set up the connection, how to deploy a machine on AI Labs and which method takes you from the first scan to root, with the AI component as the way in.

What a boot2root machine is

Boot2root is a classic CTF (capture the flag) format, where each objective is proven with a secret string called a flag. You get the address of a machine and nothing else: you map its services, find a way in, run commands as an unprivileged user and finally escalate to root.

On AI Labs the way in is always an AI component: an assistant, an agent with tools or a pipeline that feeds data through a model. Once inside, the rest of the path is that of any internal Linux assessment. Each machine has two flags in the ehe{...} format: the user flag in user.txt and the root flag in root.txt.

Before you start: the WireGuard VPN

Machines are only reachable through the labs VPN. Chatbots run in the browser and do not need it. The configuration is personal and works for all your machines: download it once from Settings, under VPN, or from any machine's page.

The .conf file contains a private key. Treat it like a password: do not publish or share it. On Windows and macOS, import it into the WireGuard app and turn the tunnel on. On Linux, use the terminal:

sudo apt install wireguard-tools
sudo wg-quick up ./ailabs.conf
sudo wg show          # you should see a recent handshake
sudo wg-quick down ./ailabs.conf   # when you are done

Deploying the machine

On the challenge page, click start lab. The platform spins up an individual, isolated instance with no Internet access and a limited lifetime. If you already have another active instance that cannot run alongside it, you will be asked whether to replace it.

Wait until the page shows the machine as ready before connecting; a Linux machine takes about a minute. Once it is ready, the page shows a private IP. That IP is your only target: do not scan whole ranges or external addresses. If you leave the challenge unfinished, stop the instance to free resources.

How to hack a boot2root machine step by step

The method is the same on every machine, even if each one pushes it to a different depth. Take notes from the first minute: if the instance expires, they let you replay the path quickly.

Start with port and service discovery against the IP on the challenge page:

  • Recon: which ports are open, and which service and version sits behind each one.
  • Enumeration: walk through the web applications, their paths and their API, and find the AI component. Note what data it reads, what tools it has and with which permissions it acts.
  • Initial access: apply AI security techniques (direct or indirect prompt injection, data leakage, tool abuse) until you get data or code execution on the system. The guides in this section cover each one.
  • User flag: with a stable shell, read user.txt in the compromised user's home directory.
  • Privilege escalation: check sudo rules, SUID binaries, scheduled tasks, services running as root, credentials in configuration files and groups with special permissions.
  • Root flag: once you have full control, read root.txt in root's home directory.
nmap -sC -sV -p- --min-rate 2000 10.x.x.x -oN nmap.txt
curl -i http://10.x.x.x/
sudo -l
find / -perm -4000 -type f 2>/dev/null

Submitting flags and troubleshooting

Submit each flag in its own field on the challenge page, copied in full: the ehe prefix, the braces and the content. Do not submit passwords or hashes instead. Correct flags save your progress immediately, and once you have both, the instance is removed automatically.

If the VPN is up but you cannot reach the machine, check that the page shows it as ready, that wg show reports a recent handshake and that no other VPN has overlapping routes. If an AI service is slow to answer, wait a few seconds and retry before switching technique.

How a system like this is defended

The machines reproduce mistakes found in real infrastructure. An exposed AI component should run as its own unprivileged user, with narrowly scoped tools and no access to secrets. Whatever the model reads and whatever it produces is treated as untrusted input.

Classic hardening still decides the outcome: an overly broad sudo rule, an unnecessary SUID binary or a password left in a configuration file turns limited access into full control of the machine.

Where to practise it on AI Labs

  • BioLabMachine · EasyFree plan
  • Aurora StationMachine · Medium
  • Stratus AnalyticsMachine · Medium
  • Forge CIMachine · Medium
  • CartógrafoMachine · Medium
  • HawkinsMachine · Medium
  • SinapsisMachine · Hard
  • Cortex AI SolutionsMachine · Hard
  • La RegentaMachine · Hard
  • VigíaMachine · Hard
  • CapitalTrust SecuritiesMachine · Hard
  • DataPipe AnalyticsMachine · Hard
  • KernelForgeMachine · Hard
  • Dédalo Due DiligenceMachine · Insane
  • EfemérideMachine · Insane

The best way to internalise this method is to use it. BioLab is included in the free plan and is the recommended first machine: it lets you try the VPN, the deployment and the full chain before moving on to medium-difficulty machines.

Create a free accountSee plans