---
# System prepended metadata

title: WALKTHROUGH FROM HTB
tags: [DevVortex WRITTE-UP]

---

Hello fellow hacker,just got bored then i thought i should write something for the sake of infosec people. DevVortex is seasonal 3 machine from HTB rated easy but somehow is not kinda easy but on the other side kinda very easy.

**OBJECTIVE**
1. Sub-domain enumeration
2. Enumerating services and version(joomla cms)
3. Exploiting joomla v4.x
4. Cracking hash offline and online
5. RCE via backdoor
6. Exploit apport-cli binary

Lets begin our pentesting now

**STEP 1: SCANNING** 
As always,were only given an ip(10.10.11.242) address so we need to move from here and exploit the system.

lets scan the target first.
![Screenshot from 2023-12-14 03-15-59](https://hackmd.io/_uploads/B17p9pPLa.png)

We got 2 open port from our first scanning.

port 22 (ssh)
port 80 (web server)

from here lets move into enumeration and dissecting our target.

**STEP 2:ENUMERATION**
From port 22 is secure remote protocol so definitly we need creds to login in here but we have no creds, so lets move into another port 

port 80 is a web server (add the ip add into your /etc/hosts)

If we browser to our domain we get this thing

![Screenshot from 2023-12-14 03-28-58](https://hackmd.io/_uploads/HyLvhpPUa.png)

Oky lets move on and try to check any interesting directories here

![Screenshot from 2023-12-14 03-31-50](https://hackmd.io/_uploads/HkmMpaDUa.png)

I Didn't find anything interesting here with this domain, so i decide to enumerate sub-domains and see if i can get anything to cook and roast.


![Screenshot from 2023-12-14 03-35-32](https://hackmd.io/_uploads/HJLe0TDLT.png)

And i found some sexy old sub-domains here to dance with, lets add this into our /etc/hosts and see what we can find in there maybe some juice information.

![Screenshot from 2023-12-14 03-38-28](https://hackmd.io/_uploads/SyboR6vUp.png)

Lets try something normally when i see a sub-domain i do its(robots.txt and source code).

robots.txt have some juice information ,so lets check it out. But source code nothing cool out there.

![Screenshot from 2023-12-14 03-39-45](https://hackmd.io/_uploads/ByMX1CwUa.png)

**STEP 3:FOOTHOLDING**
They are using joomla as there cms for more information about joomla check out this

[Reference](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjKzMK22Y2DAxVDQ_EDHXFXBckQFnoECAkQAQ&url=https%3A%2F%2Fwww.joomla.org%2F&usg=AOvVaw1MgjjaEbgdto5czwtJxvnW&opi=89978449)

After the struggle of here and there with every direcotry i got the administrator directory and it was the most interesting one for me. 

![Screenshot from 2023-12-14 03-44-08](https://hackmd.io/_uploads/rysfbRw86.png)

Got the login page for administrator, but so far we have no any user creds i stucked( default creds were not working here) and I decide to take some break first here.

Here i got stucked again because i didn't have the version of the joomla atleast i can google for its exploit,i decide to fire-up my terminal and run gobuster for searching directories again and last i found README.txt 

![Screenshot from 2023-12-14 03-59-51](https://hackmd.io/_uploads/B1Qj7RDI6.png)

Now we got some juice (joomla 4.x) and if you google it you will find it is vulnerable to Unauthenticated information disclosure

[exploit from google](https://www.exploit-db.com/exploits/51334)

**STEP 4:EXPLOITATION**
Download the exploit from exploit-db and run the exploit

**command:** ruby 51334.py http://dev.devvortex.htb 

**OUTPUT**
And we got the database juice information but also the site itself

![Screenshot from 2023-12-14 04-06-50](https://hackmd.io/_uploads/HyExL0vI6.png)

And now we have some creds after a long wait, lets try to login as lewis.

we got some users here:

**user1**:lewis (administrator)
**user2**: logan (user via ssh )

After moving around, i found a template page where i can edit and input my backdoor and get a shell.

![Screenshot from 2023-12-14 06-01-10](https://hackmd.io/_uploads/rkccxlOIT.png)

Lets edit the error.php page,copy your exploit and input it there

![Screenshot from 2023-12-14 06-05-21](https://hackmd.io/_uploads/BkYWbguIa.png)

Now we need to set a netcat listerner in our terminal and activate the exploit from this path(/templates/cassiopeia/error.php)

And now we got the reverse shell 
![Screenshot from 2023-12-14 06-07-16](https://hackmd.io/_uploads/H10u-guLa.png)

Lets stablelize our shell into something interactive 

![Screenshot from 2023-12-14 06-10-08](https://hackmd.io/_uploads/Bko7MlOUp.png)

Lets see what kind of user we are present in this system(file=/etc/passwd)

![Screenshot from 2023-12-14 06-13-29](https://hackmd.io/_uploads/HJGg7luLa.png)

We got 2 interactive user with shell root and logan. Moving direct to root is insane  method so lets start with user logan.


If we run the below (netstat -l), we will observe that we have a mysql port running(33060), And to conferm the mysql creds you can find them in the in form of plaintext /var/www/dev.devvortex/configuration.php

**mysql creds:**
mysql_user:lewis
mysql_password:REDACTED

Lets access mysql server and dump some users data here.

![Screenshot from 2023-12-14 06-26-10](https://hackmd.io/_uploads/HkUe8xOU6.png)



After we have got access to the mysql try we can try to dump the table=sd4fg_users FROM database=joomla

![Screenshot from 2023-12-14 04-56-30](https://hackmd.io/_uploads/Sy9Yb1OLa.png)

After dumping the the table (sd4fg_users) you will get the folling output.

![Screenshot from 2023-12-14 05-00-03](https://hackmd.io/_uploads/r1HPG1OLa.png)


Now lets crack the user logan because he is the one with the access with ssh  and we need that remote access.

username:logan
hash:$2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12 
cracked_hash:tequieromucho

![Screenshot from 2023-12-14 05-08-19](https://hackmd.io/_uploads/SyOpmydUT.png)

And now we need to login via ssh
username:logan@devvortex.htb
password:tequieromucho

![Screenshot from 2023-12-14 05-08-19](https://hackmd.io/_uploads/Hyr8VJ_Ia.png)

**STEP 5:PRIVILEGE ESCALATION**
Privilege esclation was simple 

**command**: sudo -l

![Screenshot from 2023-12-14 05-16-55](https://hackmd.io/_uploads/Hkpnry_Ip.png)


After googling i found out this PoC usefully here.

[Resources for root](https://github.com/alien-keric/CVE-2023-1326-PoC)

If we  read this article here [Reference](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiQuq_e8Y2DAxXIQ6QEHdiSCn0QFnoECBYQAQ&url=https%3A%2F%2Fmanpages.ubuntu.com%2Fmanpages%2Ffocal%2Fen%2Fman1%2Fapport-cli.1.html&usg=AOvVaw2A27FUF21XyzcEj8PApbLB&opi=89978449), We will understand that the binary collects data from crashed processes and compiles a problem report in /var/crash/


So in order to abuse this binary we need to specify any filename of our choice and try to  force the binary to enter in a view report and there we can execute(**!sh**) to gain root access

![Screenshot from 2023-12-14 05-40-03](https://hackmd.io/_uploads/SJ3Mi1uLa.png)

I have just specify a file named pewpew.log using option -c

![WhatsApp Image 2023-12-14 at 5.51.20 AM](https://hackmd.io/_uploads/ryRRTJdLT.jpg)


And finally we got  root access by abusing the binary.

![Screenshot from 2023-12-14 06-42-58](https://hackmd.io/_uploads/rkHyqlO86.png)


**HACK THE PLANET GUYS(By alienkeric AKA alienX)**

![Screenshot from 2023-12-14 06-41-20](https://hackmd.io/_uploads/SJXYYeuUp.png)

If you have any qns ping me from here
[Twitter AKA X](https://twitter.com/AlienKeric)