Hacking a Server with Default Passwords | TryHackMe Ignite Walkthrough

This is a deep dive into exploiting CVE-2018-16763, a critical RCE vulnerability in Fuel CMS. I'll walk you through the entire process on the TryHackMe Ignite machine, from initial enumeration and gaining admin access to downloading the exploit script, getting a reverse shell, and finally, escalating to root to pwn the box.

Quick summary / playbook

• Initial scan: only port 80 open → web app.

• Web app = Fuel CMS v1.4. Navigating to /fuel hit the admin login. Default creds admin/admin worked , instant dashboard access. Lesson: never assume default accounts are disabled.

• With the version known, searchsploit showed a pre-auth RCE (CVE-2018-16763) , used a public exploit (exploit ID 47138) and got command execution. Always check public exploit DBs after you identify versions.

• Got an unstable shell → tried various reverse shells, landed a stable www-data bash via netcat + TTY spawn tricks. Then looked for creds.

• Found fuel/application/config/database.php with DB creds: user root, password mememe. su root with that password worked , full root. Ouch

This walkthrough ties together enumeration → credential discovery → public exploit → reverse shell → privilege escalation via leaked creds — a classic real-world chain. It Shows two big operator mistakes: shipping defaults + not patching known vulns.

Full video

Full article breakdown