> For the complete documentation index, see [llms.txt](https://samfisher91.gitbook.io/samfisher-blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://samfisher91.gitbook.io/samfisher-blog/office-htb.md). # Office - HTB https\://app.hackthebox.com/machines/Office

## User found that the web cms is joomla ,after determine the version through /administrator/manifests/files/joomla.xml ,it's vulnerable to CVE-2023-23752

i used kerberute to find enum the usernames

then i sprayed the password for all those users

found this article explaining the kerberos credentials leak {% embed url="" %}

the final hash should look like this `$krb5pa$18$tstark$OFFICE.HTB$a16f4806da05760af63c566d566f071c5bb35d0a414459417613a9d67932a6735704d0832767af226aaa7360338a34746a00a3765386f5fc` Decrypt it with hashcat using model 19900 ![](https://2459792242-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4TFAEQ86UXTLdhGzyRhz%2Fuploads%2FRUELZVp6E3eTpbrYyNl8%2Fimage.png?alt=media\&token=ebdb7a1c-0f92-4f72-8b74-0adf6fcbe612) we can use this to login as an admin to joomla

visit the link in number to trigger the reverse shell

now we are user web\_account and we can use RunAs tool to get into tstark user with the credentials we got earlier tstark:playboy69 ### Root we found open port 8083 ,we forward that port to work with it

found upload webpage resume.php i used this tool to generate .odt file {% embed url="" %}

then upload the file ,and wait a bit then got revshell

now forward port 3306 ,then user msfconsole module "multi/mysql/mysql\_udf\_payload"

that user has "**SeImpersonate** " privilege ,which we can use godpotato to privilege escalation