HomeWriteupsResourcesCheatsheets

Devvortex

Devvortex writeup by Thamizhiniyan C S

Overview

Hello everyone, In this writeup we are going to solve Devvortex from HackTheBox.

Link for the machine : https://app.hackthebox.com/machines/Devvortex

Difficulty Level : Easy

Lets Start 🙌

Connect to the HTB server by using the OpenVpn configuration file that’s generated by HTB.

[ Click Here to learn more about how to connect to vpn and access the boxes. ]

After connecting to the vpn service, click on Join Machine to access the machine’s ip.

After joining the machine you can see the IP Address of the target machine.

Reconnaissance

Rustscan

rustscan -a <TARGET> -- T4 -v -A

Nmap Default Scripts

nmap -sC <TARGET>

Results

Ports
Services
Service Version

22

SSH

-

80

HTTP

-

Information Gathering - devvortex.htb

From the reconnaissance results, there is website running on port 80. I visited the website but it is redirected to the domain devvortex.htb and the domain name is not resolved.

To access the website, we have to map the domain name to the target IP. We can do this by modifying the /etc/hosts file. Append the underlined line from the image below in /etc/hosts file. The target IP might differ in your case.

After modifying the /etc/hosts file, refresh the website to see the contents of the website.

Active Infrastructure Enumeration

Headers

curl -I "http://${TARGET}"

Whatweb

whatweb -a 1 http://devvortex.htb

Wafw00f

wafw00f http://devvortex.htb

Active Subdomain Enumeration

Subdomain Fuzzing

ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.devvortex.htb/

VHost Fuzzing

ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://devvortex.htb/ -H 'Host: FUZZ.devvortex.htb' -fs 154

Results

Found no subdomains.

Found a vhost dev.devvortex.htb.

To access the vhost, add add the domain to new subdomain /etc/hosts as before and visit the subdomain in a browser.

Information Gathering - dev.devvortex.htb

After modifying the /etc/hosts file, refresh the website to see the contents of the website.

Active Infrastructure Enumeration

Headers

curl -I "http://${TARGET}"

Whatweb

whatweb -a 1 https://dev.devvortex.htb

Waw00f

wafw00f http://devvortex.htb

Results

Nothing interesting found.

Enumerating the Website - dev.devvortex.htb

Robots.txt

robots.txt - Found

From the above listed paths, the /administrator path sounds interesting.

So I first visited the /administrator path.

Its a Joomla Administrator Login page.

I first tried for some default credentials like admin:admin, but didn’t work.

Droopescan

Next I used droopescan tool to enumerate the joomla website.

LogoGitHub - SamJoan/droopescan: A plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly Drupal & Silverstripe.GitHub

droopescan scan joomla --url http://dev.devvortex.htb/

From the results of droopescan , I visited http://dev.devvortex.htb/administrator/manifests/files/joomla.xml to check for version information.

The joomla.xml was accessible and got the joomla version: 4.2.6.

Next I searched for exploits for the above mentioned version and found the following:

CVE-2023-23752

LogoJoomla! v4.2.8 - Unauthenticated information disclosureExploit Database

After taking a look at the exploit, the exploit basically makes requests to the following endpoints and parses the response data and displays it to us:

/api/index.php/v1/users?public=true

/api/index.php/v1/config/application?public=true

So, instead of running the exploit, I directly visited the above endpoints in the browser.

The first endpoint responded with a list of users.

And the second endpoint responded with the configuration of the application which also had the password of the user lewis, that we found in the previous endpoint, who is part of the Super Users group.

Initial Access

With credentials lewis:P4ntherg0t1n5r3c0n##, that we found in the enumeration process, I tried to login in the joomla administrator page and was able successfully login.

Since we got access to administrator dashboard, I checked out whether it is possible to inject or modify the code in the available templates as mentioned here:

LogoJoomla - HackTricksbook.hacktricks.xyz

We can see the available templates under the system tab of the dasboard. I decided to try to modify the administrator template.

Next select the following.

In the template customize page you can see a list of available files and options to create, edit, save and delete files.

I decided to create a php file that contains the code to fetch a reverse shell back to us from the server. First click New File.

There is a option to upload a file, I tried to upload a php reverse shell, it didn’t work. So I decided to create a new file and copy the contents of the php reverse shell to the file. To do so enter the file name and choose the extension as php and then click create.

I used the pentest monkey php reverse shell:

http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gzpentestmonkey.net

I copied the contents of the reverse shell and pasted in the editor. Don;t forget to update your tun0 IP address in the reverse shell.

Now click Save&Close and start a netcat listener using the command nc -lvnp 1234.

Now visit the following URL: http://dev.devvortex.htb/administrator/templates/atum/<nameTheFileThatYouCreated>.php and check your reverse shell.

Now we got the reverse shell back.

I first upgraded my shell using the command: python3 -c "import pty;pty.spawn('/bin/bash')”.

We can see that, currently we are the user www-data.

Now its time to look out for privilege escalation vectors.

Privilege Escalation

Getting The User Flag

First I checked the available users in the target machine.

There is another user named logan. And I checked the /home/logan folder which has the user flag, but we don’t have permissions to read it.

Next I was looking out for some basic privilege escalation vectors, but got nothing. Then I remembered the about the credentials that we used to login to Joomla which we can use to try to login to the mysql database.

mysql -u lewis -p [ -p - to mention password based login ]

I was able to successfully login and found a database named joomla.

Next I tried to view the available tables using command: show tables;

The above command responded with a long list of which sd4fg_users table got my attention.

Next I viewed the contents of the sd4fg_users table.

It had two users with their password hashes, which seems like a usual linux user account password hash ( blowfish hash ). Since we know that there is another user in the machine named logan, I tried to crack the logan user’s password hash using john.

And I got it cracked and I used the password to login as logan to the target machine via ssh.

I was able to successfully login and also got the user flag.

Getting The Root Flag

Next, again started looking out for privilege escalation vectors. Started with sudo -l command and got the following output.

The user logan can only run /usr/bin/apport-cli with root privileges. apport-cli is basically a tool that generate crash reports. Next I checked the version of the apport-cli

I searched about the above version of apport-cli and found the following commit:

Logofix: Do not run sensible-pager as root if using sudo/pkexec · canonical/apport@e5f78ccGitHub

which is a POC for to use this tool to escalate our privileges.

I tried it. But I wasn’t able to find the crash file in the /var/crash location. Then I was searching on google on how to create the crash file and got following crash file content from

LogoOfficial Devvortex DiscussionHack The Box :: Forums

I manually created a crash file at /var/crash with .crash extension with the above content and the exploit just worked fine as mentioned in the POC.

To get a root shell enter the below command in the pager view: !/bin/bash

We have successfully got a shell with root privileges.

Successfully got the root flag.

Thank You……

PreviousEasyNextSau

Last updated

Was this helpful?