Context

Sometimes in a pentest, you get root access very quickly. But is it the real root or just a container? The voyage might still be going on.

Starting hypothesis

Chain multiple vulnerabilities to gain control of a system.

Method / Used Tools

Flag 1

Initial Reconnaissance

A full TCP port scan was performed against the target:

nmap -p- 10.66.123.204

The scan revealed multiple exposed services, most notably:

• HTTP on ports 80 and 81
• SSH
• LDAP
• VNC
• RDP

The presence of an HTTP service on port 80 warranted further inspection.

Joomla Identification & Vulnerability Discovery

Inspecting the HTML source code of the web page hosted on port 80 revealed embedded Joomla configuration data, confirming the CMS in use.

Based on this finding, research led to CVE‑2023‑23752, a Joomla Authentication Bypass vulnerability allowing unauthenticated access to sensitive API endpoints by setting the public=true parameter.