root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat devvortex.md
// writeups

Devvortex

25 Nov 2023 · 10 min read · root access
writeupshacktheboxlinuxEasyretiredvip
Devvortex - maquina de Hack The Box

Executive summary — Devvortex is a very current Easy Linux box: a hidden subdomain (dev.devvortex.htb) hosts a Joomla 4.2.6 vulnerable to CVE-2023-23752, which leaks the database credentials unauthenticated. With them we log into Joomla's admin panel and inject a webshell through the template editor (RCE as www-data); a bcrypt hash dumped from the users table gives SSH once cracked, and root comes from abusing apport-cli via sudo (CVE-2023-1326), forcing a crash and escaping from the less pager. A vhost fuzzing → Joomla → info leak → RCE → MySQL → SSH → apport-cli → root path.

PlatformHack The Box
Operating systemLinux (Ubuntu)
DifficultyEasy
StatusRetired
Target IP10.129.16.227

Attack map

[22,80] nmap → SSH held in reserve, nginx with no CMS on the default vhost
   │  whatweb + ffuf (Host: FUZZ) → dev.devvortex.htb (Joomla 4.2.6)
   ▼
CVE-2023-23752 — /api/.../config/application?public=true → MySQL creds (lewis)
   │  reused on Joomla's admin panel
   ▼
[Joomla admin]  template editor (Atum) → webshell → RCE (www-data)
   │  MySQL → sd4fg_users table → logan's bcrypt hash → hashcat (19 s)
   ▼
[SSH]  logan : tequieromucho  (user.txt)
   │  sudo -l → /usr/bin/apport-cli (ALL : ALL)
   ▼
[ROOT]  CVE-2023-1326: forced crash → apport-cli opens less as root → !/bin/bash

1. Recon

1.1 Port scan

Without knowing what the box exposes, a full scan of every TCP port (not just the top-1000) avoids missing services on high ports.

nmap -p- --min-rate 5000 -sV -sC -oA devvortex 10.129.16.227
22/tcp open  ssh    OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
80/tcp open  http   nginx/1.18.0 (Ubuntu)

Only two ports: SSH is kept in reserve until we have credentials, and HTTP is the main attack surface.

1.2 Technology fingerprinting

whatweb http://devvortex.htb
curl -I http://devvortex.htb
Bootstrap, jQuery 3.4.1, nginx 1.18.0, Ubuntu Linux

The main domain shows no CMS at all — it's a static page. That suggests the real application lives elsewhere, likely a different vhost that nginx routes by the Host header.

1.3 Subdomain fuzzing

nginx commonly acts as a reverse proxy and decides which backend to serve based on the request's Host header. Swapping that header for every word in a wordlist, and filtering out responses identical to the default vhost's, uncovers subdomains that don't resolve in public DNS.

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://devvortex.htb -H 'Host: FUZZ.devvortex.htb' -fc 302,301
dev  [Status: 200, Size: 23221]   (the default vhost's response is 18048 bytes)

dev.devvortex.htb returns a different size than the default vhost: a different application sits behind it. Added to /etc/hosts:

echo "10.129.16.227  dev.devvortex.htb" | sudo tee -a /etc/hosts

1.4 Identifying Joomla

whatweb http://dev.devvortex.htb
curl -s http://dev.devvortex.htb/administrator/ | head -50

The /administrator/ path is Joomla's classic login screen. The exact version is confirmed from the installation's manifest file:

curl -s http://dev.devvortex.htb/administrator/manifests/files/joomla.xml | grep '<version>'
<version>4.2.6</version>
🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.