How to shell vBulletin 3.8.8 Alpha 2

Hey guys....
any tips on shelling a vBulletin 3.8.8 Alpha 2?
Got the mod , and com manager accounts already but cant manage to get the admin passes...

or anyone able to crack one of those hashes?would pay for them

e8f9362dd3f5a55bc5552d497b5e656a:@-k
010fe40e5e134202f6a35cb0b92b72ea:+.d
00e39c368cf0a4740cf5bef460f98114:5~*
0F29DF9662D3F7EF1BB33B39BF49EC92:Ms.

md5(hash:salt)

You can use CSRF2RCE to get shell, you can escalate to admin privy by abusing the mod panels global announcement feature using arbitrary javascript payloads, it's not hard to get admin accounts if you already have a mod account, it works on any CMS where the mod panel has a global embedded object similar to VB's announcements as well.