$#cms

3 writeups

VulnHubEasy03 Jun 2026

VulnHub: Boot2root (Rick & Morty)

A CeWL-generated wordlist cracks Joomla admin, template editing gets a reverse shell, and hardcoded credentials in an automation script complete a sudo (ALL:ALL) escalation to root.

#web
#cms
#privesc
#credential-access

VulnHubEasy11 Apr 2026

VulnHub: DC-1

Drupalgeddon2 (CVE-2018-7600) gets an in-memory shell via Metasploit, then a SUID find binary hands over root through a one-line GTFOBins exploit.

#web
#cms
#rce
#privesc

VulnHubMedium11 Apr 2026

VulnHub: Venom

An MD5 hash in a page comment cracks FTP access, a hint file and a Vigenère cipher unlock a CMS admin panel, and a known Subrion CMS RCE leads to root via a hardcoded backup password.

#web
#cms
#rce
#cryptography