THM Machine DailyBugle
export ip=10.10.13.177Scanning
Nmap
Enumeration
HTTP
Content-Discovery
administrator endpoint has a Joomla login page.
Joomla Version Detection For Version Detection, I search on Google and there are some results that show us how to detect the Joomla version. But I don't get any useful results with some of that. Then I got the following conversation that show me what type of version Joomla is using and they also mentioned the tool that can detect automatically.
Joomla-Version Detection Tool
By seeing the source code of the above tool they have some endpoints that show us the version of Joomla.
The above joomla.xml file has the following content that mentioned a version number.
This file shows us the version 3.7.0 in April 2017 and also disclosed some useful file names/web directories.
Using the above information and searching for vulnerabilities in that version guess what I found. [+] Found Public Documented SQLi Vulnerability
In the above exploit, they show the sqlmap command to exploit the vulnerability.
Using SqlMap Found the following valid Databases.
For further enumeration, we use the following commands.
The above command shows us all the tables of the joomla database but they show some tables like this #__table-name. There # symbol shows there are some random alpha-numeric characters. We got a table name #__user now we can dump its columns with the following command.
Note: I write
#__userin quotes so you should use it like that otherwise you don't get anything The above command starts brute-forcing the columns. We can guess that and start dumping data from it.
Password Hashes
Password Cracking When I use hash-identifier on the above hash they tell me it's a blowfish(bcrypt) hash now let's start cracking it.
It takes too much time but we can get the password spiderman123
Initial Access
I try to login to ssh with that credentials but it doesn't work. So I Try to login to joomla and that works there.
After Login to the /administrator endpoint, we can go Extension the drop-down menu on Web Site Header, There we can go to Templates we can select any template, and change their php code. So knowing that we can change that php code and add a reverse shell code there after visiting that payload injected page we can get the reverse shell back to our attacking machines. Note: I use a simple php command execution payload because PentestMonkey PHP Code gives some error. So when I get Command Execution I use a simple mkfifo reverse shell payload to get a shell
After I got the reverse shell I read configuration.php and there are Mysql credentials.
My SQL Credentials
we can use these credentials to login with a local user jjameson with the following command
Privilege Escalation
User jjameson can run the yum command using sudo with No PASSWD. With the help of GTFObins show us the full payload we can run and get the root shell.
Using the above command we eventually get the elevated /bin/sh shell that has a root user's permission. Now we are root we can read the user.txt and root.txt the file that has our flags that we can submit to TryHackMe.
Last updated
Was this helpful?