A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
I was three hours into an external assessment with nothing to show for it. Every endpoint was patched. Then I hit the e-commerce subdomain. Joomla 3.9.4. The admin login at /administrator accepted admin:admin. Twenty minutes later I had a shell.
The robots.txt file reveals the directory structure: /administrator/, /components/, /modules/, /plugins/, /templates/. Each is worth probing. The README.txt at the webroot confirms the major version branch. The cache.xml file at plugins/system/cache/cache.xml gives approximate version info.
Joomla sets the admin password at install time, so there's no universal default. But weak passwords are common. The login page returns a generic error for invalid users, so username enumeration won't work here. Focus on password guessing against the known admin account.
Once inside the admin panel, navigate to Extensions → Templates → protostar. Open error.php. Inject a PHP one-liner with a non-standard parameter name.
system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']);
Use an MD5 hash as your parameter name instead of cmd. A drive-by attacker scanning for common webshell parameters won't find yours. Also restrict access to your source IP if the shell persists more than a few minutes.
This traversal can read configuration.php, which contains database credentials. If the admin panel isn't externally accessible but the traversal is, those creds might work elsewhere. The vulnerability also allows file deletion, but that's destructive—avoid it on real engagements.
Joomla holds 3.5% of the CMS market. That's millions of potential targets running outdated extensions with default credentials. Would you check /administrator on every Joomla site you find?
Finish the lesson once you have worked through the material. This awards ★ 30 XP.