joshuavanderpoll/cve-2021-3129Laravel RCE Exploit PoC - CVE-2021-3129 (user-friendly with automatic log path detection)
This script is designed to exploit the Remote Code Execution (RCE) vulnerability identified in several Laravel versions, known as CVE-2021-3129. By leveraging this vulnerability, the script allows users to write and execute commands on a target website running a vulnerable Laravel instance, provided that the "APP_DEBUG" configuration is set to "true" in the ".env" file.
Thanks everyone for all the GitHub stars! ❤️ Really appreciate the support! 🚀
[!NOTE] To ensure a clean and isolated environment for the project dependencies, it's recommended to use Python's
venvmodule.
git clone https://github.com/joshuavanderpoll/CVE-2021-3129.git
cd CVE-2021-3129
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt
git clone https://github.com/joshuavanderpoll/CVE-2021-3129.git
cd CVE-2021-3129
python -m venv .venv
.venv\Scripts\activate
pip3 install -r requirements.txt
docker build -t laravel_vulnerable .
docker run -p 8000:8000 laravel_vulnerable
env (Updates the .env file to set APP_DEBUG to false)index (Injects code into index.php which prevents access to "/_ignition/execute-solution")private (Same as the index option, but allows specific header to access "_ignition/execute-solution")This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by the tool.