Devvortex — Credentials¶

Target: 10.129.229.146 (devvortex.htb / dev.devvortex.htb)

User	Password / Hash	Type	Source	Access Granted	Tested
`lewis`	`P4ntherg0t1n5r3c0n##`	Cleartext	Joomla API leak — `/api/index.php/v1/config/application?public=true`	Joomla admin panel (`dev.devvortex.htb/administrator/`)	✅ Works
`lewis`	`P4ntherg0t1n5r3c0n##`	Cleartext	Same — this is the MySQL DB password from Joomla config	MySQL (not yet tested)	⬜ Untested
`www-data`	n/a — shell via webshell	Shell	Cassiopeia `error.php` template backdoor	Web shell on target	✅ Active
`lewis`	`$2y$10$6V52x.SD8Xc7hNlVwUTrI.ax4BIAYuhVBMVvnYWRceBmy8XdEzm1u`	bcrypt (cost 10)	`joomla.sd4fg_users` (id 649)	n/a — cleartext already known	⬜ Not cracking (redundant)
`logan`	`$2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12`	bcrypt (cost 10)	`joomla.sd4fg_users` (id 650)	cracked → see below	✅ Cracked
`logan`	`tequieromucho`	Cleartext	Cracked from bcrypt, rockyou	SSH (port 22)	✅ Works

Notes¶

Password reuse — the key observation¶

P4ntherg0t1n5r3c0n## was leaked as the database password in Joomla's configuration, but it also authenticates lewis to the Joomla web admin panel.

Same secret, two different services. That reuse is what turned an information disclosure into admin access. Always test a leaked credential against every service on the box, not just the one it was labelled for.

It has not yet been tested against MySQL directly or against SSH (port 22).

Source of the leak¶

Unauthenticated Joomla API endpoint exposed application config including user and password fields for the database connection. Joomla 4.0.0–4.2.7 are in the vulnerable window (this box runs 4.2.6).

MySQL access¶

lewis authenticates to local MySQL (127.0.0.1:3306) with the same password. DB: joomla · table prefix: sd4fg_ (random, taken from configuration.php).

Syntax gotcha: mysql -u lewis -p <password> with a space treats the next token as the database name, producing ERROR 1044 ... to database '<password>'. That 1044 means auth succeeded, authorization failed — not a bad password. Use mysql -u lewis -p and enter it at the prompt.

Target account¶

logan — UID 1000, /bin/bash, /home/logan (owns user.txt). SSH open on 22. Only account on the box worth pivoting to.

Cracking notes — `logan`¶

hashcat -m 3200 loot/logan.hash /usr/share/wordlists/rockyou.txt
→ tequieromucho   (21 seconds)

Speed was 64 H/s (CPU-only, PoCL on i5-8600K). Cracked fast only because the password sits at candidate ~1,400 of 14,344,385 — the top 0.01% of rockyou.

Worst case on this hardware: 14.3M ÷ 64 ≈ 62 hours for a full pass. Rule of thumb before committing to a slow hash: keyspace ÷ H/s = worst-case seconds. If that reads "days," find another path instead.

Still to collect¶

Local users — only logan (UID 1000) is a real user
Joomla configuration.php — DB creds, db joomla, prefix sd4fg_
Joomla users table — 2 bcrypt hashes recovered
Crack logan's bcrypt hash → tequieromucho
SSH as logan
Test tequieromucho for reuse (MySQL root? other services?)
Post-logan enumeration for root path