---
# System prepended metadata

title: Curling!

---

# Curling!
## @Author : M3tr1c_r00t

![Curling](https://user-images.githubusercontent.com/99975622/202869168-893257fe-43f1-4fee-8579-112d77190d0b.png)

### Enumeration
We run an nmap scan and find we have two ports that are open...
![Screenshot_2022-11-17_01_18_38](https://user-images.githubusercontent.com/99975622/202869187-75754eee-16da-49ea-b14c-d04801212ae8.png)

Lets move to firefox and check out the site...

![Screenshot_2022-11-17_01_20_40](https://user-images.githubusercontent.com/99975622/202869329-d5e58c2b-bce2-4748-82d4-56697e332400.png)
Note that after the article for 2018, there's a name :_floris_ maybe its a username?


Running a gobusterscan we find some interesting directories...
![Screenshot_2022-11-17_01_18_49](https://user-images.githubusercontent.com/99975622/202869222-c14146f7-a977-49c8-889a-9d3a28cbce80.png)

I ran the gobuterscan again using -x txt,php and found a file: **secret.txt**
![Screenshot_2022-11-17_01_19_52](https://user-images.githubusercontent.com/99975622/202869257-d30c54bd-5f3c-45cf-bb47-afee26f9d127.png)

It was hashed in base64.
![Screenshot_2022-11-17_01_20_20](https://user-images.githubusercontent.com/99975622/202869282-cfbff554-9870-44e5-bf80-f9fc57b72f48.png)
On decrypting, we find a credential which seems to be a password...
On the joomla login page, we try the username as _floris_ and the password as _Curling2018!_ and it works!

We also see something interesting at the bottom right corner of the site. Its the joomla version. _**Joomla 3.8.8**_

After a bit of googling, we find out that the joomla version has a vulnerability that allows for RCE... via the templates and can help us to get a reverse shell 
![Screenshot_2022-11-17_01_21_38](https://user-images.githubusercontent.com/99975622/202869914-2e9cfd1c-813e-4424-aa6f-deddeb1d4502.png)
I chose the B33z template and modified the index.php file 
![Screenshot_2022-11-17_01_21_50](https://user-images.githubusercontent.com/99975622/202870341-75902e2d-c274-4343-9fe0-15ba63d32303.png)

You can use the phpreverseshell from pentestmonkey 
![Screenshot_2022-11-17_01_22_25](https://user-images.githubusercontent.com/99975622/202870885-93a7b439-4b38-4869-b5fa-e7ca45fac49f.png)
and make sure to change the LHOST and LPORT ....

![Screenshot_2022-11-17_01_22_42](https://user-images.githubusercontent.com/99975622/202870894-e92cbce6-dc58-4f1a-974e-966846d56b62.png)

Set up a listener and run go to the index file and boom! 
You get your reverse shell....

![Screenshot_2022-11-17_01_23_29](https://user-images.githubusercontent.com/99975622/202870922-420ab6d2-4c5e-43a8-a380-fec91d4808dd.png)
Although we have the rev shell, permissions were limited. I ran linpeas and find the pwnkit vulnerability

![Screenshot_2022-11-17_01_26_33](https://user-images.githubusercontent.com/99975622/202870945-ab915181-b120-4a61-bcc6-dfeccc3ed6e9.png)
After uploading the python script, run the file and you get root.

![Screenshot_2022-11-17_01_28_41](https://user-images.githubusercontent.com/99975622/202870972-01cb5fd8-78e3-4526-8573-c3933dc96c40.png)
Now you can get your user and root flags!
And done!
### Socials
@Instagram:https://instagram.com/M3tr1c_r00t
<br>@Twitter:https://twitter.com/M3tr1c_root


