关联漏洞
描述
A short and sweet simple exploit script for the CVE-2012-2982 Authenticated RCE vulnerability in the /file/show.cgi/bin endpoint.
介绍
# CVE-2012-2982-Exploit-Script
A short and sweet simple exploit script for the CVE-2012-2982 Authenticated RCE vulnerability in the /file/show.cgi/bin endpoint.
# Webmin RCE Exploit — CVE-2012-2982
This repository contains a Python proof-of-concept exploit for **Webmin <= 1.580**, targeting a known remote code execution vulnerability via the `/file/show.cgi/bin/` endpoint.
---
## 📌 Description
The exploit abuses unauthenticated shell command injection through crafted URLs, leveraging the `session_login.cgi` and `file/show.cgi/bin/` endpoints. If login credentials are valid and the target is vulnerable, an injected reverse shell payload is executed.
---
## ⚙️ Requirements
- Python 3.x
- `requests` library
- Netcat (for reverse shell listener)
---
## 🚀 Usage
### Run the exploit:
```bash
python3 exploit.py
````
### Start a listener BEFORE running exploit:
```bash
nc -lvnp <your-port>
```
---
## 🧠 Notes
* Payload defaults to a `bash -i` reverse shell.
* A trailing `|` in the injected payload is critical for successful execution.
* Tested against Webmin 1.580. Will likely work on versions previous.
---
## 🔒 Disclaimer
For educational and authorized testing use **only**.
Unauthorized use of this exploit is illegal and unethical. For which i take no responsibility.
文件快照
[4.0K] /data/pocs/18668cc9e33c2197eed130ba95759973db07a7eb
└── [1.3K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。