VulnHub: Boot2root (Rick & Morty)
A CeWL-generated wordlist cracks Joomla admin, template editing gets a reverse shell, and hardcoded credentials in an automation script complete a sudo (ALL:ALL) escalation to root.
Nmap Scan
nmap -p- -sV -sC -A -vv 192.168.11.112
Four ports open: 22 (SSH), 80 (HTTP), and 111 / 38717 (RPC).
Web Enumeration (Port 80)
The web server serves a Bootstrap-based landing page:
Directory Fuzzing
ffuf -u http://192.168.11.112/FUZZ -w /usr/share/wordlists/dirb/big.txt
A /Joomla directory turns up quickly:
Fuzzing inside /Joomla/ and inspecting the source didn’t yield an immediate vulnerability — which points toward credential discovery as the way in, rather than an exploit.
Exploitation: Custom Wordlist & Brute Force
CeWL builds a custom wordlist directly from the site’s own content:
That tailored dictionary successfully brute-forces the admin account:
Gaining Admin Access
Gaining a Shell: Template Manipulation
Joomla’s admin panel allows editing templates directly. Navigating to the Beez3 template and modifying one of its PHP files to include a reverse shell:
After starting a local listener and previewing the modified template, the reverse shell connects back:
nc -lvnp 4444
Shell Stabilization
python -c 'import pty; pty.spawn("/bin/bash")'
# [CTRL+Z]
stty raw -echo; fg
export TERM=xterm
Privilege Escalation
Enumeration turns up a Python automation script with hardcoded credentials for another system user (redacted here — password and username both visible in the original find):
Lateral Movement
Those credentials pivot to a second user over SSH:
Vertical Escalation to Root
Checking sudo privileges reveals a critical misconfiguration — the user is granted (ALL : ALL) ALL:
| Tactic | Finding |
|---|---|
| Vulnerability | Misconfigured sudoers (/etc/sudoers) |
| Impact | Full system compromise (EUID=0) |
The flag is retrieved from /root with the newly obtained root shell.
Takeaways
- No exploit code anywhere in this chain — every step was a configuration weakness: fuzzable content that fed a targeted wordlist, an admin panel that allows arbitrary PHP execution by design, and an automation script that hardcoded a password instead of using a credential store.
- CeWL turning the site’s own words into the wordlist that cracked its own admin account is a good reminder that generic rockyou-style lists aren’t always the right first move — the target’s own content is often a better source.
(ALL : ALL) ALLin sudoers is about as close to “game over” as a misconfiguration gets; it’s worth being one of the first things checked on any foothold, not the last.