CVE-2019-15107 PoC — Webmin 命令操作系统命令注入漏洞

Description

webmin <=1.920 - RCE via command injection vulnerability

介绍

# CVE-2019-15107

https://www.cvedetails.com/cve/CVE-2019-15107/

An issue was discovered in Webmin <=1.920. The parameters "old" and "expire" in password_change.cgi contain a command injection vulnerability.

### Usage
1. Start a listener on red box.
```
   rlwrap -cAr nc -lvp 1919
```
2. Run the exploit
```
   ./exploit.sh
```
3. Arguments will be prompted:
    * ip address of the target
    * target port running webmin (usually 10000)
    * local listener port
    * local interface where the listener is running (eth0, tun0, etc)

Let the stuff run, a reverse shell is received on listener.

### Example
![image](https://user-images.githubusercontent.com/120142960/229232531-14fdb88c-71f2-4c8b-aacf-35965ed5051b.png)

### License
Feel free to use or modify whenever and wherever you like

文件快照

备注