Webmin File Manager Access-Control Bypass to Root RCE

This repository contains an enhanced exploit for CVE-2022-0824, a critical remote code execution vulnerability in Webmin versions prior to 1.990. The exploit is implemented in a single Python script (exploit.py) and supports two main attack modes: direct command execution and reverse shell. The attacker provides the target Webmin URL, valid credentials, and (optionally) a shell command or reverse shell callback parameters. The script generates unique CGI payloads in Perl, Bash, or Python, uploads them to the target via the Webmin file manager, and triggers their execution. The exploit features robust file management, automatic cleanup of old payloads, and detailed logging. The README provides comprehensive usage instructions, parameter explanations, and security recommendations. The main attack vector is network-based, targeting the Webmin management interface over HTTP(S). The exploit is operational and can be used for both proof-of-concept and practical exploitation in authorized security testing scenarios.

This repository contains a single Metasploit module exploit targeting Webmin version 1.984 on Linux (CVE-2022-0824). The exploit leverages a vulnerability that allows any authenticated user (even without File Manager access) to abuse file manager functionalities to upload and execute a malicious CGI payload, resulting in remote code execution. The module automates the process: it logs in with provided credentials, uses the File Manager's HTTP endpoints to download a payload from the attacker's HTTP server, modifies its permissions, and executes it to establish a reverse shell. The exploit is weaponized, supporting customizable payloads via the Metasploit framework. The main file is written in Ruby and follows standard Metasploit module structure, with clear separation of functions for each exploitation step. Key fingerprintable endpoints include the Webmin File Manager CGI scripts and the path where the payload is stored and executed.

This repository contains a Python exploit script (Webmin-revshell.py) targeting Webmin versions 1.984 and below, specifically exploiting CVE-2022-0824 and CVE-2022-0829. The exploit leverages improper access control in the File Manager module, allowing a less privileged authenticated user to upload and execute a reverse shell with root privileges. The script automates the process: it generates a Perl reverse shell payload, logs into the target Webmin instance, hosts a local HTTP server to serve the payload, uses Webmin's file manager endpoints to download and set permissions on the payload, and finally executes it to establish a reverse shell connection to the attacker's machine. The repository includes a README with detailed usage instructions and a .gitignore file. The main exploit logic is contained in a single Python file, which interacts with several Webmin HTTP endpoints and requires attacker-controlled infrastructure (HTTP server and listener). The exploit is operational and provides a working reverse shell if the target is vulnerable and properly configured.