Devvortex

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Devvortex (Ubuntu, attack surface: OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) (22), nginx 1.18.0 (Ubuntu) (80)). Foothold via the vulnerable entry point; privilege escalation via sudo, password reuse. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC 10.10.11.242 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sV -sC 10.10.11.242 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sV -sC 10.10.11.242 --min-rate 1000     
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-11 01:23 PST
Nmap scan report for 10.10.11.242
Host is up (0.018s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
|   256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)
|_  256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devvortex.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 46.07 seconds

1. Based from the nmap results, the machine runs a web application on port 80 and opens ssh logins on port 22.

2. Next, I tried to do directory listing and enumerating subdomains using dirsearch and ffuf.

Found a subdomain --> dev.

dev.devvortex.htb

1. Running dirsearch again, found bunch of endpoint but one of them administrator shall be our interest.

2. Turns out, it is Joomla login page. The webapp using Joomla CMS.

3. Searching on the internet for joomla login's default creds, shall leads to nothing.

4. Running dirsearch again but this time without wordlist, found README.txt file and other interesting files.

5. Accessing it, shows us the joomla's version.

VERSION 4.2

1. Searching on the internet about the exploit for Joomla v4.2, found this promising github's POC.

2. Reading another POC on exploitdb, seems this is what we are looking for.

3. Great, let's use it and follow the procedure provided at the github's README.

4. To run the ruby file, there are 3 gems needed. Those are httpx, docopt, and paint.

5. All three can be installed by running:

sudo gem install httpx
sudo gem install docopt
sudo gem install paint

EXPLOITING

1. Awesome! We got mysql db cred.
2. However, it's worth to try the cred to login at the Joomla login page, I assume there is password reuse.

TURNS OUT IT IS --> We're loggged in

1. Next, I start to check the system option, then go to the Warning notification.

The warning message

1. Seems it is not our interest.

2. Long story short, I tried to add a simple bash reverse shell at index.php.

3. Actually, maybe you can add at any .php files here, but make sure you access it to trigger the payload.

4. The payload itself, I outsourced it from PayloadAllTheThings.

5. Click save accessing index.php shall trigger our payload.

GOT THE SHELL

1. Great! Now let's use mysql to access lewis DB.

Using mysql --> lewis:P4ntherg0t1n5r3c0n##

mysql -u lewis -pP4ntherg0t1n5r3c0n## -e "show databases;"

mysql -u lewis -pP4ntherg0t1n5r3c0n## -e "use joomla; show tables;"

1. Noticed, we got bunch of results. But our interest is at the users table.

mysql -u lewis -pP4ntherg0t1n5r3c0n## -e "use joomla; select username, password from sd4fg_users;"

1. Awesome! We got 2 creds, we can crack the password using john.

2. Long story short, john succeed to crack only for logan --> logan:tequieromucho.

3. To make sure whether logan is our objective or not. I check what's inside passwd file at the docker container.

4. It is indeed logan.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerating subdomain using ffuf.
2. Directory listing using dirsearch.
3. Exploiting CMS Joomla v4.2 --> CVE-2023-23752.
4. Accessing mysql (inline command).
5. Cracking password using john.
6. Exploiting apport-cli bin for privilege escalation --> CVE-2023-1326.