Office¶

Machine Profile

OS: Windows Server (Active Directory) Difficulty: Hard IP: 10.129.230.226 Domain: office.htb Pwned: User flag 25 Mar 2026 (system flag in progress) Key techniques: Joomla CVE-2023-23752 · LibreOffice macro · Active Directory pivot

Reconnaissance¶

53     DNS
80     HTTP — Apache 2.4.56 / PHP 8.0.28
88     Kerberos
389    LDAP
443    HTTPS
445    SMB
3268/9 LDAP GC

Web Recon¶

Iron-Man themed site running Joomla. Tech fingerprint:

Joomla CMS
Apache 2.4.56
PHP 8.0.28
OpenSSL 1.1.1t
Windows Server

Dirsearch finds the Joomla admin panel and an interesting CGI endpoint:

/cgi-bin/printenv.pl

printenv.pl is a Perl test CGI that dumps the server environment — including HTTP_HOST=office.htb, DOCUMENT_ROOT=C:/xampp/htdocs, and confirming the box is XAMPP on Windows.

VHOST enumeration uncovers demo.office.htb.

Initial Foothold — CVE-2023-23752 (Joomla Config Disclosure)¶

Joomla 4.x prior to 4.2.8 has an unauthenticated REST endpoint that returns the global configuration, including database credentials and admin secrets:

curl "http://office.htb/api/index.php/v1/config/application?public=true"

The response includes:

{
  "user": "Administrator",
  "password": "H0lOgrams4reTakIng0Ver754!"
}

Those credentials log into the Joomla admin panel at /administrator/. Inside Joomla admin, multiple paths to RCE exist — for this box, the template editor is the simplest: edit a PHP template file and inject a webshell. POST the shell with cmd=whoami to confirm.

The webshell runs as the XAMPP Apache user — but printenv.pl revealed the box is C:/xampp/htdocs, so file system access is broad.

User Flag Path — Pivot to AD Credentials¶

Inside the box, a user file tony.kj contains credentials:

tstark : playboy69

tstark is a real AD user. Validate with netexec:

netexec smb 10.129.230.226 -u tstark -p 'playboy69' --shares

tstark has read access to the SOC Analysis share, which contains an old .pcap capture from a SOC investigation. Opening it in Wireshark, an NTLMSSP authentication is visible — the hash for another user (hhogan) can be extracted with pcredz or manually.

Crack with hashcat:

hashcat -m 5600 hhogan_ntlmssp.hash /usr/share/wordlists/rockyou.txt

hhogan is in the Joomla server admin group → RDP / WinRM access:

evil-winrm -i 10.129.230.226 -u hhogan -p '<cracked>'

user.txt retrieved.

Privilege Escalation — Work In Progress¶

System flag attempted via: - LibreOffice macro injection (a high-priv account periodically opens documents from a shared folder) - Kerberos delegation abuse (one of the discovered accounts has constrained delegation rights)

Notes will be expanded when the chain is completed.

Key Takeaways¶

CVE-2023-23752 is a free credential dump for any Joomla 4.x install that hasn't been patched. The ?public=true parameter on the API endpoint is the trigger.
PCAPs in shared folders are gold. SOC analysts dump captures for review; if those captures contain SMB or HTTP auth, NTLMSSP responses are extractable and crackable.
XAMPP on Windows = unrestricted file system access from the web user. There's no chroot, no jail, no AppArmor.

Tools Used¶

nmap · dirsearch · ffuf · curl · Joomla API exploitation · netexec · Wireshark · pcredz · hashcat · evil-winrm