# Devvortex

{% embed url="<https://app.hackthebox.com/machines/Devvortex>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

## Summary

An Nmap scan identified open SSH and Nginx web server ports. Through directory and VHOST scanning, the target `dev.devvortex.htb` was pinpointed, revealing a vulnerable Joomla CMS on its administrator page. Exploiting a known RCE vulnerability in Joomla version 4.2.6, MySQL database credentials were extracted and used to gain administrative access at the Joomla backend.

With administrative access, a web shell was uploaded to Joomla, allowing command execution on the server. This capability led to a reverse shell as `www-data`, and subsequent access to user `logan`'s account after cracking password hashes found in the database.

The final stage involved exploiting a vulnerability in `apport-cli` for privilege escalation. By creating a crash report and escaping out of a crash report view, a root shell was spawned, providing complete control over the system.

## Recon

We scan the target with a Nmap scan and discover 2 open ports. We have SSH on port 22 and a Nginx web server in version `1.18.0` on port 80

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F8L2Roccj0gVu0kh5B1od%2Fgrafik.png?alt=media&#x26;token=743087f5-22ce-4d06-9645-e54f5856f020" alt=""><figcaption></figcaption></figure>

We then enumerate the web server's directories using Gobuster, but find nothing special.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FLFeTqPQjMiOuXtTHdSuB%2Fgrafik.png?alt=media&#x26;token=efbdaba2-db68-4603-90b8-ff653a5dd977" alt=""><figcaption></figcaption></figure>

Inspecting the site manually only reveals static links and no possible entry points.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FyZM20Zbouo0ZVQMIjiuI%2Fgrafik.png?alt=media&#x26;token=74c067d7-f2e2-46f8-acad-e0c2c269d8a4" alt=""><figcaption></figcaption></figure>

We use Ffuf to enumerate further VHOSTs, and we find what we are looking for: `dev.devvortex.htb` will be our next target.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FEGNh411CE4ndABECYWAi%2Fgrafik.png?alt=media&#x26;token=ef5c269f-f5fd-4593-92fa-d84346ee94be" alt=""><figcaption></figcaption></figure>

A directory scan on `dev.devvortex.htb` reveals an administrator page and an api page. A little more interesting.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FbBpYr0VcgK0oRFYjGAcJ%2Fgrafik.png?alt=media&#x26;token=c507f613-dbee-4a15-ab30-800dd39670fd" alt=""><figcaption></figcaption></figure>

The index page is not that promising.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FgkE2EjBmaOIUPbTOsoJT%2Fgrafik.png?alt=media&#x26;token=4fb07888-7ca0-470c-9af1-62b97505549e" alt=""><figcaption></figcaption></figure>

When we visit the administrators page, we see that we are dealing with the Joomla cms.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FO0ToQHYd3V8KY0TfpnAJ%2Fgrafik.png?alt=media&#x26;token=7db8d787-c5a8-43ca-a391-f8ab1c2990ca" alt=""><figcaption></figcaption></figure>

## Shell as www-data

Let's see what kind of version and possible vulnerabilities we are dealing with this Joomla. For this we make use of `joomscan`. And we are dealing with version `4.2.6`.

```sh
joomscan --url http://dev.devvortex.htb
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FOUd0Hd5gwtlgz7E04EDF%2Fgrafik.png?alt=media&#x26;token=17224ede-babb-4b05-a7f1-4bb558b9c26e" alt=""><figcaption></figcaption></figure>

After a short research, we find an RCE vulnerability for this old version, whose POC can also be found in the following article. First, we are dealing with an information leak vulnerability that allows us unauthorized to extract sensitive information such as MySQL database credentials in clear text.

{% embed url="<https://vulncheck.com/blog/joomla-for-rce>" %}

With the following request to the web server, we receive the MySQL credentials of the user `lewis`.

```sh
┌──(0xb0b㉿kali)-[~/Documents/htb-app/devvortex]
└─$ curl -v http://dev.devvortex.htb/api/index.php/v1/config/application?public=true
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FdTAqHpzwqwsv4l8XDiW5%2Fgrafik.png?alt=media&#x26;token=8088a065-64f8-44dc-a158-f47956e5e4bc" alt=""><figcaption></figcaption></figure>

On exploit-db you can also find a ruby script that provides a clearer output.

```
sudo gem install httpx
sudo gem install docopt
sudo gem install paint

https://www.exploit-db.com/exploits/51334
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F0l7hiBtA59ocfOmWyHGL%2Fgrafik.png?alt=media&#x26;token=d488ab9c-b5f7-433a-ad22-6bc371a42382" alt=""><figcaption></figcaption></figure>

Next, we try to log in with those credentials via SSH and the Joomla login. And are able to log in successfully at Joomla. Nice, now we need to manage to get a web shell.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F6liR7N2iis0dVr6DlAwk%2Fgrafik.png?alt=media&#x26;token=0d9b15ef-26a1-4421-9e43-47c8bd020905" alt=""><figcaption></figcaption></figure>

For this, there are various web shell plugins for Joomla available:

{% embed url="<https://github.com/p0dalirius/Joomla-webshell-plugin>" %}

We request the following page, and we see that we are allowed to upload plugins.

```
http://dev.devvortex.htb/administrator/index.php?option=com_installer&view=install 
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FJoMFaYtbWHdmUrmsKQZq%2Fgrafik.png?alt=media&#x26;token=5a715301-fac1-4fe0-97d1-a8df0fbcebf7" alt=""><figcaption></figcaption></figure>

Next, we download the web shell plugin mentioned before and build it.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FFmuhSavOJUOm2eNGJCbZ%2Fgrafik.png?alt=media&#x26;token=296dd057-78f7-41bc-9f39-57d68bd8b8e8" alt=""><figcaption></figcaption></figure>

Then we can just drop the created zip into the field of uploading and installing Joomla extensions.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FNu4LknuCm7UHo77ICq2n%2Fgrafik.png?alt=media&#x26;token=c30f21ee-72e2-45ae-8a6d-239e31a69151" alt=""><figcaption></figcaption></figure>

Now we are able to execute commands at the following page.

```url
http://dev.devvortex.htb/modules/mod_webshell/mod_webshell.php?action=exec&cmd=id
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FYwfE5fEOea7BefjudNLx%2Fgrafik.png?alt=media&#x26;token=98ef518e-81b8-4079-82ea-62a3d0eb73ba" alt=""><figcaption></figcaption></figure>

The exploit also comes with a python script that makes the web shell a bit more interactive. However, it is still a web shell. We use revshells.com, set up a listener and spawn a reverse shell.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FvqJPaMHeXuPDj7tfXntE%2Fgrafik.png?alt=media&#x26;token=b8921572-d70d-45d8-8416-a2d434500951" alt=""><figcaption></figcaption></figure>

After having the interactive reverse shell as `www-data` we upgrade the shell. Unfortunately, we did not reach the user flag yet.

{% embed url="<https://0xffsec.com/handbook/shells/full-tty/>" %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FyWbzHq5iKicqtqoqRgEo%2Fgrafik.png?alt=media&#x26;token=a3f036bd-721e-4775-9a04-ace6951e3afe" alt=""><figcaption></figcaption></figure>

## Shell as logan

We have the user logan on the system. From our automated exploit `CVE-2023-23752`, we know that logan is also registered with Joomla. We may also find his credentials in the user database. With a bit of luck, these could have been reused. We use the credentials from the previous steps to login to the MySQL database.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FTeDAyCI1wgVtfLYFU32L%2Fgrafik.png?alt=media&#x26;token=8696954f-23a5-454c-a7bc-42473f658d5c" alt=""><figcaption></figcaption></figure>

`sd4fg_users` looks promising.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fwze225is8WILrbIBGgJa%2Fgrafik.png?alt=media&#x26;token=0fe056e0-5966-4638-ac18-620861e57f85" alt=""><figcaption></figcaption></figure>

Querying the contents of the table `sd4fg_users`, we find the hashes of `lewis` and logan.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FZtUMFC3MT8RYpAJVV5kC%2Fgrafik.png?alt=media&#x26;token=0e9d5a75-2b2f-4d20-8408-bfb51d138b8f" alt=""><figcaption></figcaption></figure>

The hash is a `bcrypt $2*$, Blowfish (Unix)` hash and can be cracked with mode `3200`.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FBKFSAgAdc89C8YojsitX%2Fgrafik.png?alt=media&#x26;token=d13363b9-1a55-4b4b-82f9-9055f43a0e19" alt=""><figcaption></figcaption></figure>

We are able to log in with the credentials of logan and find the user's flag in the home directory of the user.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FoA2mfDDFgkrzB7bODRXl%2Fgrafik.png?alt=media&#x26;token=4b8d2021-974e-485a-b8bd-7cda72150999" alt=""><figcaption></figcaption></figure>

## Shell as root

When enumerating as logan, we immediately notice that we can call `/usr/bin/apport-cli` using sudo. Not the nasty binary found on GTFOBins. So let's take a look at the version to find possible vulnerabilities.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FD9ky3M65lq9rQL7YKaR4%2Fgrafik.png?alt=media&#x26;token=f6e29577-8853-4e19-b6c6-c79578246b89" alt=""><figcaption></figcaption></figure>

After a little research, we find what we need. Our version is vulnerable and allows us to extend our rights. In short, when we read a crash report, we can spawn a shell. Below are all the resources and explanations found:

{% embed url="<https://github.com/advisories/GHSA-qgrc-7333-5cgx>" %}

> A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to [CVE-2023-26604](https://github.com/advisories/GHSA-8989-8fhv-vq42). If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.

{% embed url="<https://vuldb.com/?id.225896>" %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FxfawFHtPTPvamqYvTOj8%2Fgrafik.png?alt=media&#x26;token=1be962fe-9bbc-4930-be79-d5882026ba4d" alt=""><figcaption></figcaption></figure>

{% embed url="<https://github.com/canonical/apport/commit/e5f78cc89f1f5888b6a56b785dddcb0364c48ecb>" %}

> The apport-cli supports view a crash. These features invoke the default pager, which is likely to be less, other functions may apply.&#x20;
>
> It can be used to break out from restricted environments by spawning an interactive system shell. If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.
>
> apport-cli should normally not be called with sudo or pkexec. In case it is called via sudo or pkexec execute \`sensible-pager\` as the original user to avoid privilege elevation.
>
> Proof of concept:
>
> `$ sudo apport-cli -c /var/crash/xxx.crash`&#x20;
>
> `[...]`
>
> `Please choose (S/E/V/K/I/C): v`&#x20;
>
> `!id`
>
> `uid=0(root) gid=0(root) groups=0(root)`&#x20;
>
> `!done (press RETURN)`&#x20;
>
> This fixes [CVE-2023-1326](https://github.com/advisories/GHSA-qgrc-7333-5cgx).&#x20;
>
> Bug: <https://launchpad.net/bugs/2016023> Signed-off-by: Benjamin Drung <<benjamin.drung@canonical.com>>

Unfortunately, we do not have any crash reports on the system. What a pity.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FnOwRvIW8xtb6mzPuFwgO%2Fgrafik.png?alt=media&#x26;token=35a1652e-67a4-4905-aaa2-fe856eb59512" alt=""><figcaption></figcaption></figure>

But we can create one ourselves using the parameter tag `-f`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FpJY3kbSq7HYYX0pY0dnY%2Fgrafik.png?alt=media&#x26;token=56773970-dd88-4a93-a7fb-8de127a550bf" alt=""><figcaption></figcaption></figure>

After creating the report we can immediately view the report by entering V. There we place `:!/bin/bash` to spawn a shell, since we run this in the context of root using sudo we get a `root` shell, and are able to reach out to `/roo`t and read the root flag at `/root/root.txt`.<br>

```
:!/bin/bash
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FEtotnQ0CHThiPRl9WTrJ%2Fgrafik.png?alt=media&#x26;token=4dcbf504-1b1b-440b-a6d0-92c9279f93fe" alt=""><figcaption></figcaption></figure>

Another way to generate a crash report could be to kill a process with the SIGSEGV signal, which would mean a SEGFAULT.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FsYOUHTnu64341Bgj6yFi%2Fgrafik.png?alt=media&#x26;token=5fb2bd46-e3f0-4714-9fc5-f13b6e0cfd43" alt=""><figcaption></figcaption></figure>

1. **Background Execution of `sleep` Command:**`sleep 10 &` starts a background process that pauses for 10 seconds, allowing parallel command execution.
2. **Inducing a Segmentation Fault:**`killall -SIGSEGV sleep` sends a segmentation fault signal to all active `sleep` processes. The `SIGSEGV` signal forces these processes to terminate as if they encountered an invalid memory access. This action results in the operating system generating a crash report, useful for debugging and testing system error handling.

We can then read in the report using `-c` and enter `!:/bin/bash` to spawn a root shell.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FY7t0dCt21JeCaOGYhTmJ%2Fgrafik.png?alt=media&#x26;token=cce5c259-ad9b-46ad-a9f0-7ed3bf4acfc2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FoSCQLzf7L4152Dp8T1ZL%2Fgrafik.png?alt=media&#x26;token=030cae96-547d-4da2-bec2-86702f7ff479" alt=""><figcaption></figcaption></figure>
