Webmin password_change.cgi Command Injection RCE

This repository is a small proof-of-concept exploit for CVE-2019-15107, a Webmin remote code execution vulnerability in the password change functionality. The repo contains three files: a Python exploit script (PoC.py), a README explaining the bug and reproduction steps, and a docker-compose.yml file that launches a vulnerable Webmin 1.910 instance from Vulhub for testing. The main exploit capability is arbitrary command execution against a vulnerable Webmin server over HTTPS. PoC.py accepts a target in IP:port form and an optional command (default: id). It constructs a POST request to /password_change.cgi, disables TLS certificate verification, and injects the attacker-controlled command into the old parameter while setting supporting fields user, pam, expired, new1, and new2. It also sets a Referer header to /session_login.cgi. If the server responds with HTTP 200, the script prints the full response body, which may include command output. Operationally, this is a straightforward exploit rather than a scanner or framework module. It does not include persistence, lateral movement, or staged payload delivery; instead it provides direct command execution with user-supplied commands. The README states that successful exploitation can yield root-level execution and notes the vulnerable configuration requirement passwd_mode=2. The docker-compose file exposes port 10000 and uses the vulhub/webmin:1.910 image, making local reproduction easy. Overall, the repository’s purpose is to demonstrate and reproduce Webmin RCE via the password_change.cgi old parameter injection path, not merely detect the issue.

This repository is a small standalone Python proof-of-concept exploit for unauthenticated remote command execution against vulnerable Webmin releases associated with CVE-2019-15107. The repo contains one primary code file (cve-2019-15107.py), a minimal README showing invocation syntax, a requirements.txt for Python dependencies, and standard license/gitignore files. The exploit logic is straightforward and operational: it accepts a target URL, optional port, and arbitrary command from the operator. It constructs a target endpoint at /password_change.cgi on the supplied host (default port 10000), sets Webmin-like cookies, and uses /session_login.cgi as the Referer header. It first performs a GET request to /password_change.cgi to determine whether the target appears promising by checking for HTTP 200, the string 'Failed' in the response body, and a Server header version in the vulnerable range 1.890-1.920. It then performs a probe command using echo 'vulnerable Webmin!' to verify command execution. If the probe output is reflected in the response, it submits the operator-provided command and prints the returned response body. The exploit sends the command in POST form fields 'expired' and 'old', covering both the 1.890 behavior and the 1.900-1.920 variant. This indicates the exploit is intended to support multiple vulnerable Webmin versions with a single request structure. TLS certificate validation is explicitly disabled, allowing exploitation of HTTPS services with self-signed or invalid certificates. Overall, the repository's purpose is offensive exploitation rather than mere detection: it validates the vulnerability and then executes arbitrary commands remotely. It is not part of a larger exploit framework, and its single-script structure makes it a direct standalone RCE tool.

This repository is a small standalone Python proof-of-concept exploit for CVE-2019-15107, the Webmin unauthenticated RCE caused by a backdoored password change component. The repository contains only three files: an MIT LICENSE, a README describing the vulnerability and usage, and the main exploit script cve-2019-15107.py. The exploit script is the sole code file and clear entry point. It uses argparse for CLI handling, requests for HTTP(S) interaction, regex for parsing command output, and subprocess to launch a local netcat listener. It is not part of a larger exploitation framework. Core capabilities: - Detects likely vulnerable Webmin versions by sending benign echo markers through two payload formats. - Supports exploitation of Webmin 1.890 via the expired parameter. - Supports exploitation of later backdoored releases up to 1.920 via the old parameter in password_change.cgi, with supporting form fields. - Offers two operator modes: single-command execution with output extraction, or a Perl reverse shell that connects back to the attacker. - Can optionally route traffic through a proxy and can force exploitation attempts even if version detection fails. Exploit flow: 1. Build target URL from scheme, rhost, and rport. 2. POST to /password_change.cgi with crafted form data and Webmin-like cookies/Referer. 3. Detect vulnerability by checking for echoed markers in the HTTP response. 4. If command mode is selected, wrap the command with __START__/__END__ markers and parse returned output. 5. Otherwise, start a local nc listener and send a Perl reverse shell one-liner that connects back to the supplied lhost:lport and executes /bin/bash -i. Fingerprintable behavior includes requests to /password_change.cgi and use of /session_login.cgi as the Referer, default targeting of TCP/10000, optional proxying through 127.0.0.1:8080, and reverse shell callbacks to an attacker-controlled host/port. Overall, this is a real, functional operational exploit for unauthenticated Webmin RCE rather than a detector-only script.

This repository is a small standalone Python proof-of-concept exploit for CVE-2019-15107, an unauthenticated command injection vulnerability in Webmin <= 1.920. The repository contains only three files: an MIT LICENSE, a README with usage/examples, and the main exploit script cve-2019-15107.py. The exploit script uses argparse for CLI handling, requests for HTTP(S) communication, subprocess to launch a local netcat listener, and time for simple synchronization. Its workflow is straightforward: parse user-supplied target and callback parameters, optionally verify the target by injecting a benign echo marker, start a local listener, then send a malicious POST request to Webmin's password_change.cgi endpoint. The request includes crafted form data where the expired parameter carries shell metacharacters and a Perl reverse-shell one-liner. If successful, the target connects back to the attacker on the supplied LHOST/LPORT and executes /bin/bash -i over that socket. Main capabilities: - Unauthenticated vulnerability check using a command-injection echo test. - Exploitation of Webmin password_change.cgi via POST request. - Automatic local listener startup using nc -lvnp. - Reverse shell delivery using an embedded Perl payload. - Optional HTTP or HTTPS transport and optional proxy support. Notable implementation details: - The exploit disables TLS certificate warnings and sets verify=False, indicating it is intended for self-signed or lab environments. - It sets a Referer header pointing to session_login.cgi, likely to resemble normal Webmin traffic. - The script is operational rather than highly flexible: it provides a working hardcoded reverse-shell payload but does not offer modular payload selection or framework integration. Overall, this is a genuine, compact operational exploit targeting exposed Webmin instances vulnerable to CVE-2019-15107, intended to obtain remote shell access over the network.

This repository contains two Python files. The main exploit is 'webmin-CVE-2019-15107.py', which targets the Webmin application vulnerable to CVE-2019-15107 (command injection in /password_change.cgi). The script allows an attacker to interactively execute arbitrary system commands on a vulnerable Webmin server by sending crafted POST requests to the /password_change.cgi endpoint, using the 'expired' parameter to inject commands. The script disables SSL warnings and requires the attacker to provide the target's IP and port as arguments. The exploit is operational, providing an interactive shell-like interface for command execution. The second file, 'keyboard.py', is unrelated to the exploit and simply demonstrates keyboard automation using the pynput library. The repository is focused on exploiting Webmin servers over the network via HTTPS endpoints.

This repository contains a Python exploit script (CVE-2019-15107.py) and a README.md for CVE-2019-15107, a critical unauthenticated remote command execution (RCE) vulnerability in Webmin (versions prior to 1.930). The exploit works by sending a crafted POST request to the '/password_change.cgi' endpoint of a vulnerable Webmin server, injecting arbitrary shell commands via the 'expired' parameter. The script first checks if the endpoint is accessible, then sends the exploit payload with custom headers to bypass authentication. The README provides usage instructions, example output, and demonstrates how to use the exploit to obtain a reverse shell. The exploit is operational, allowing attackers to execute arbitrary commands or gain shell access without authentication, provided the target is vulnerable and accessible over the network.

This repository contains a Python proof-of-concept exploit for CVE-2019-15107, a critical unauthenticated remote code execution vulnerability in Webmin versions 1.890 through 1.920. The main file, CVE-2019-15107-PoC.py, is a standalone script that allows a user to check if a target Webmin instance is vulnerable and, if so, provides an interactive menu to execute arbitrary system commands as root via the /password_change.cgi endpoint. The exploit works by sending a specially crafted POST request with the 'expired' parameter set to the desired command, leveraging a backdoor in the Webmin source code. The script supports both built-in commands (such as listing users, system info, running processes, etc.) and custom command execution. The repository also includes a README with detailed usage instructions, affected versions, and references, as well as a requirements.txt for dependencies. No hardcoded IPs or domains are present; the script is designed for user-specified targets. The exploit is a functional POC and not part of a larger framework.

This repository contains a Python exploit script (webmin_rce.py) and a README.md for CVE-2019-15107, a remote code execution vulnerability in Webmin <=1.920. The exploit targets the /password_change.cgi endpoint of Webmin, sending specially crafted POST requests to execute arbitrary commands as root. The script determines the Webmin version to select the appropriate payload format. It then constructs a Perl reverse shell payload, which is injected via the vulnerable endpoint, causing the target to connect back to the attacker's machine (specified by the -l and -p arguments) and provide a root shell. The exploit is unauthenticated and operational, requiring only network access to the vulnerable Webmin instance. The repository is structured simply, with the main exploit logic in webmin_rce.py and usage instructions in the README.md.

This repository contains a Python exploit script (webmin_exploit.py) targeting CVE-2019-15107, an unauthenticated remote code execution vulnerability in Webmin <=1.920 (demonstrated on 1.890). The exploit abuses the password_change.cgi endpoint over HTTPS (default port 10000) to execute arbitrary commands as root. The script sends a specially crafted POST request to the endpoint, injecting a Perl reverse shell payload that connects back to the attacker's machine, providing a root shell. The repository includes a README with usage instructions, a requirements.txt for dependencies (requests library), and a standard GPL license. The main entry point is webmin_exploit.py, which requires the attacker to specify the target and listener details. The exploit is operational, providing a working reverse shell payload, and is not part of a larger framework.

This repository contains a Python exploit script (CVE_2019_15107.py) and a README for CVE-2019-15107, a critical unauthenticated remote command execution vulnerability in Webmin <=1.920. The exploit targets the '/password_change.cgi' endpoint, abusing the 'old' password field to inject arbitrary system commands. The script takes a target URL and a command as arguments, sends a crafted POST request, and prints the command output if the target is vulnerable. The README provides usage instructions, example requests, and references. The exploit is operational, requiring the target to have the password reset function enabled and accessible. No framework is used; the code is standalone Python. The main fingerprintable endpoint is the Webmin password change CGI script, typically accessible at 'https://<target>:10000/password_change.cgi'.

This repository contains a Python exploit script (webmin_rce.py) targeting CVE-2019-15107, a remote code execution vulnerability in Webmin <=1.920. The exploit is unauthenticated and leverages a backdoor in the 'password_change.cgi' endpoint. The script determines the Webmin version and crafts a POST request to the vulnerable endpoint, injecting a Perl reverse shell payload that connects back to the attacker's specified host and port. The exploit is operational, providing a root shell if successful. The README provides usage instructions and example requests, and the repository is structured with a single exploit script, a README, a license, and a .gitignore. The main fingerprintable endpoint is '/password_change.cgi', and the exploit is network-based, requiring only access to the Webmin HTTP(S) interface.

This repository contains a Python exploit for CVE-2019-15107, targeting Webmin version 1.890. The exploit leverages an unauthenticated remote command execution vulnerability in the Webmin 'password_change.cgi' endpoint. The repository consists of two files: a README.md with detailed usage instructions and exploit.py, the main exploit script. The script allows the attacker to execute arbitrary commands on the target Webmin server or obtain a reverse shell. It supports optional use of a proxy (Burp Suite at 127.0.0.1:8080) for request interception. The exploit is operational, requiring only the target's IP address; other options include specifying the port, command, or requesting a reverse shell. The payload is delivered via a crafted POST request to the Webmin service over HTTPS. The exploit is not part of a framework and is self-contained.

This repository provides a complete lab environment and exploit scripts for CVE-2019-15107, a remote command execution vulnerability in Webmin versions 1.890 and 1.920. The repository contains two Python exploit scripts (webmin1.890_rce_exp.py and webmin1.920_rce_exp.py), each targeting a specific Webmin version. These scripts send crafted POST requests to the /password_change.cgi endpoint on the target Webmin server, exploiting the vulnerability to execute arbitrary shell commands as root. The output of the command is extracted from the server's response and displayed to the attacker. Additionally, the repository includes Dockerfiles for both Webmin 1.890 and 1.920, allowing users to quickly set up vulnerable test environments. The Dockerfiles configure Ubuntu containers with Webmin installed and expose port 10000, with default credentials (root:pass) for easy access. The README provides instructions for building and running the Docker containers, as well as accessing the Webmin interface. Overall, this repository is designed for security researchers to easily reproduce and exploit CVE-2019-15107 in a controlled environment, demonstrating the impact of the vulnerability and providing practical exploit code.

This repository contains a Python exploit for CVE-2019-15107, a remote code execution vulnerability in Webmin versions 1.890 through 1.920. The main exploit script (CVE-2019-15107.py) allows an attacker to execute arbitrary shell commands on a vulnerable Webmin server by sending specially crafted POST requests to the 'password_change.cgi' endpoint. The script provides an interactive pseudo-shell for command execution and can spawn a Perl-based reverse shell to an attacker-controlled host. The exploit is mostly automated, performing connectivity and version checks before exploitation, and includes options for SSL, custom base directories, and ports. The repository is structured with a single main exploit script, a README, a requirements file listing dependencies (argparse, requests, urllib3, prompt_toolkit), and standard license and gitignore files. The exploit targets network-accessible Webmin servers and requires the password change feature to be enabled. No hardcoded IPs or domains are present; the attacker supplies the target and callback information at runtime.

This repository contains a Python proof-of-concept exploit for CVE-2019-15107, a remote code execution vulnerability in Webmin's password_change.cgi endpoint. The main file, CVE-2019-15107.py, allows an attacker to check if a target Webmin instance (typically on port 10000) is vulnerable and, if so, exploit it to gain a reverse shell. The exploit works by sending a specially crafted POST request to the /password_change.cgi endpoint, injecting a bash command that connects back to the attacker's machine. The script supports both single-target and multi-target (file-based) scanning, and includes a built-in listener for the reverse shell. The repository also includes a README.md with usage and disclaimer information, and a requirements.txt listing Python dependencies. The exploit is operational, providing a working reverse shell payload, and is intended for use against vulnerable Webmin installations.

This repository contains a Python proof-of-concept exploit for CVE-2019-15107, targeting Webmin version 1.890. The exploit leverages a backdoor in the password change functionality to achieve remote command execution as root. The main file, 'Webmin_exploit.py', is a command-line tool that takes the target host, port (default 10000), and a command to execute. It sends a crafted HTTPS POST request to the '/password_change.cgi' endpoint, exploiting the backdoor to run arbitrary commands. The README provides usage instructions and context about the vulnerability. No detection or fake code is present; this is a functional exploit. The only code file is in Python, and the attack vector is network-based, requiring access to the Webmin service over HTTPS.

This repository contains a proof-of-concept exploit for CVE-2019-15107, a command injection vulnerability in Webmin (versions prior to 1.930). The exploit is implemented in a single Python script ('myexploit.py'), which sends a crafted POST request to the vulnerable Webmin 'password_change.cgi' endpoint. The payload is a Perl reverse shell command that, when executed, connects back to the attacker's machine (IP and port must be set in the script). The README provides usage instructions, including setting up a netcat listener and modifying the script for the attacker's IP and port. The exploit requires network access to the target Webmin instance and is operational, providing a working reverse shell if successful. No detection or scanning functionality is present; the script is solely for exploitation.

This repository contains a Python exploit script (CVE-2019-15107.py) targeting the Webmin web management interface vulnerability CVE-2019-15107. The exploit works by sending a crafted POST request to the '/password_change.cgi' endpoint of a vulnerable Webmin server, injecting arbitrary system commands via the 'old' password parameter. The script disables SSL warnings, constructs appropriate headers, and prints the result of the command execution if successful. The README provides a brief usage example. The repository is straightforward, with one exploit script and a README, and is designed to achieve remote command execution on Webmin servers vulnerable to CVE-2019-15107.

This repository is a C-language exploit for CVE-2019-15107, targeting Webmin versions <=1.920. The exploit is structured as a command-line tool that takes a target URI as input. It checks if the target is running a vulnerable version of Webmin by inspecting HTTP headers, determines if SSL is required, and then tests for the vulnerability by injecting a command via the 'old' parameter of the /password_change.cgi endpoint. If the target is confirmed vulnerable, the tool provides an interactive pseudo-shell, allowing the attacker to execute arbitrary commands remotely. The code is modular, with headers for CURL operations, utility functions, and global variables. The exploit is operational and provides a real, interactive payload, but is not part of a larger framework. The main entry point is src/main/main.c, and the exploit leverages libcurl for HTTP(S) requests. The README provides compilation and usage instructions, as well as an example target. The only hardcoded endpoint is /password_change.cgi, and the exploit is designed for unauthenticated remote command execution.