> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/other/cms/joomla.md).

# Joomla

Open-source Content Management System (CMS)

Joomla is written in PHP and uses MySQL in the backend.

## Tools

<table><thead><tr><th width="149">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/oppsec/juumla">Juumla</a></td><td>Identify Joomla version, scan for vulnerabilities and sensitive files.<br><code>python3 main.py -u &#x3C;URL></code></td></tr><tr><td><a href="https://github.com/drego85/JoomlaScan">JoomlaScan</a></td><td>A free and open source software to find the components installed in Joomla CMS.<br><code>sudo python2.7 -m pip install &#x3C;urllib3,certifi,bs4></code> <br><code>python2.7 joomlascan.py -u &#x3C;URL></code></td></tr><tr><td><a href="https://github.com/droope/droopescan">droopescan</a></td><td>A plugin-based scanner that aids security researchers in identifying issues with several CMS.<br><code>droopescan scan joomla --url &#x3C;URL></code></td></tr><tr><td><a href="https://github.com/ajnik/joomla-bruteforce">joomla-bruteforce</a></td><td>The default administrator account on Joomla installs is <code>admin</code>, but the password is set at install time.<br><code>python3 joomla-brute.py -u &#x3C;URL> -w &#x3C;WORDLIST> -usr admin</code></td></tr></tbody></table>

## Default File Structure

```
/var/www/html
├── administrator  (backend administration)
│   ├── cache  (cache for the admin panel)
│   ├── components  (backend-specific components)
│   ├── help  (admin help files)
│   ├── includes  (admin inclusion files)
│   ├── language  (language files for the admin panel)
│   ├── logs  (backend logs)
│   ├── modules  (admin-specific modules)
│   ├── templates  (admin panel templates)
│   ├── manifests  (manifest XML files for extensions)
│   │   ├── files
│   │   │   ├── joomla.xml  (main Joomla manifest file)
│   │   │   ├── libraries.xml  (manifest for Joomla libraries)
│   │   │   ├── modules.xml  (manifest for modules)
│   │   │   ├── plugins.xml  (manifest for plugins)
│   │   │   ├── templates.xml  (manifest for templates)
│   ├── index.php  (admin login page)
│   ├── configuration.php (main Joomla configuration file)
│   ├── .htaccess  (optional rewrite rules for backend security)
│   └── .htpasswd  (optional, extra authentication layer)
├── bin  (Joomla CLI scripts)
├── cache  (site cache files)
├── cli  (Joomla command-line scripts)
├── components  (installed frontend components)
│   ├── com_content  (Joomla core content component)
│   ├── com_users  (Joomla user management component)
│   ├── com_banners  (Joomla banner management)
│   └── com_contact  (contact form component)
├── images  (image and media files)
├── includes  (Joomla core inclusion files)
├── installation  (only present before installation)
├── language  (frontend language files)
│   ├── en-GB
│   │   ├── en-GB.ini  (main language file)
│   │   ├── en-GB.com_content.ini  (language file for content component)
│   │   ├── en-GB.mod_menu.ini  (language file for menu module)
│   │   ├── en-GB.plg_system_cache.ini  (language file for cache plugin)
├── layouts  (layout overrides)
├── libraries  (Joomla core libraries)
│   ├── cms  (CMS-related libraries)
│   ├── joomla  (Joomla framework)
│   ├── legacy  (legacy support for older versions)
│   ├── src  (new namespace structure for Joomla 4+)
├── logs  (system log files)
├── media  (static files and media assets)
│   ├── system  (system-related media files)
│   │   ├── css  (core CSS files)
│   │   ├── images  (system images)
│   │   ├── js  (Joomla system JavaScript files)
├── modules  (frontend modules)
│   ├── mod_menu  (menu module)
│   ├── mod_search  (search module)
│   ├── mod_login  (login module)
├── plugins  (installed plugins categorized by type)
│   ├── authentication  (authentication plugins)
│   │   ├── ldap  (LDAP authentication plugin)
│   │   │   ├── ldap.php
│   │   │   ├── ldap.xml  (manifest file for LDAP plugin)
│   ├── content  (content-related plugins)
│   │   ├── pagebreak
│   │   │   ├── pagebreak.php
│   │   │   ├── pagebreak.xml  (manifest file for pagebreak plugin)
│   ├── editors  (text editors like TinyMCE)
│   │   ├── tinymce
│   │   │   ├── tinymce.php
│   │   │   ├── tinymce.xml  (manifest file for TinyMCE plugin)
│   ├── system  (core system plugins)
│   │   ├── cache
│   │   │   ├── cache.php
│   │   │   ├── cache.xml  (manifest file for cache plugin)
│   │   ├── debug
│   │   │   ├── debug.php
│   │   │   ├── debug.xml  (manifest file for debug plugin)
│   │   ├── remember
│   │   │   ├── remember.php
│   │   │   ├── remember.xml  (manifest file for remember-me plugin)
├── templates  (frontend templates)
│   ├── system  (core template files)
│   ├── protostar  (default template for Joomla 3)
│   ├── cassiopeia  (default template for Joomla 4+)
│   ├── templates.xml  (manifest file for templates)
├── tmp  (temporary files)
├── configuration.php  (site configuration file)
├── htaccess.txt  (sample .htaccess file)
├── index.php  (main entry point for the website)
├── robots.txt  (SEO robots file)
└── web.config.txt  (configuration file for IIS servers)
```

## Manual Enumeration

### Version

<table data-header-hidden><thead><tr><th width="178"></th><th></th></tr></thead><tbody><tr><td>Source code</td><td>Meta tag of name generator:<br><code>&#x3C;meta name="generator" content="Joomla! - Open Source Content Management" /></code></td></tr><tr><td><code>README.txt</code></td><td>In the Joomla root directory</td></tr><tr><td><code>LICENSE.txt</code></td><td>In the Joomla root directory</td></tr><tr><td><code>joomla.xml</code></td><td>in <code>/administrator/manifests/files/joomla.xml</code></td></tr><tr><td><code>cache.xml</code></td><td>in <code>plugins/system/cache/cache.xml</code></td></tr></tbody></table>

## Attacks

### Built-in

Login with Admin user.\
Click on `Templates` on the bottom left under `Configuration` to pull up the templates menu. Next, we can click on a template name. Let's choose `protostar` under the `Template` column header. This will bring us to the `Templates: Customise` page. Finally, we can click on a page to pull up the page source and add a PHP one-liner to gain code execution. Once this is in, click on `Save & Close` at the top

{% code overflow="wrap" %}

```bash
curl -s http://<DOMAIN>/templates/protostar/error.php?cmd=id
```

{% endcode %}