Webmin 1.050 - 1.060 remote exploit

• Previous message: http-equiv@excite.com: "O UT LO OK E XPRE SS 6 .00 : broken"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: Carl Livitt <carl@learningshophull.co.uk>
To: bugtraq@securityfocus.com
Date: Mon, 24 Feb 2003 12:45:43 +0000

Hi all,

Attached is an exploit for the latest Webmin vulnerability. It relies on a
non-default setting (passdelay) to be enabled.

Webmin can verify user authentication by use of a session ID (SID) that is
assigned when a user successfully authenticates to Webmin. It is possible to
inject a fake SID into the session ID database by using a malicious username
containing control sequences used internally by Webmin.

This exploit simply creates a SID of 1234567890 for the user 'admin'. Then, it
is a simple case of creating a cookie in your favorite browser containing:

sid=1234567890; testing=1

Such that the Cookie HTTP header contains:

Cookie: sid=1234567890; testing=1

When the webmin server recieves this cookie, it is verified as an authentic
SID and an attacker can take complete control of the Webmin server... this is
basically root access to the box it is running on.

Cheers,
Carl

• text/x-perl attachment: webmin-exploit.pl

• Next message: FreeBSD Security Advisories: "FreeBSD Security Advisory FreeBSD-SA-03:03.syncookies"
• Previous message: http-equiv@excite.com: "O UT LO OK E XPRE SS 6 .00 : broken"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]