CVE-2012-2982

Python POC for CVE-2012-2982 (Webmin 1.580) improved from the original by user OstojaOfficial

This is an improved version of the original script that allows the user to see the input data format without needing to view the entire script to discover it. To achieve this, that section of code was simply moved to the beginning:

At the same time, an exit instruction is appended to prevent the script from continuing to run (sys.exit(1)).

Also added is the possibility for the user to include the port on which the Webmin 1.580 service runs from the moment they call the exploit.

Since a new input was added, all other data are modified, along with the modification of the query URL to log in and exploit the vulnerability.

Finally, the main functionality is added that will execute the script if it receives all the data correctly.

NOTE: Remember that before executing the script you must install the required libraries. To do so, simply type in a console:

pip3 install -r requirements.txt

In case you have never used pip3, it should be installed with the following command:

apt install python3-pip

If when reinstalling the requirements.txt the following error appears:

Execute the following command to fix it. The error is due to ldap not being installed on the system.

apt-get install build-essential python3-dev python2.7-dev \ libldap2-dev libsasl2-dev slapd ldap-utils tox \ lcov valgrind