Apache HTTP Server 2.4.49 Path Traversal and Potential RCE

This repository is a small exploit-development lab for CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49. It contains one executable code file, poc.py, plus supporting documentation in README.md, exploit_report.md, and vulnerability_notes.md. The PoC is a minimal Python script using the requests library to send a single HTTP GET request to a local lab target at http://127.0.0.1:8080 with the crafted path /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd. Its purpose is to demonstrate unauthorized file disclosure by retrieving /etc/passwd and checking for the string "root:" in the response. The exploit does not provide code execution, persistence, or post-exploitation features; it is strictly a file-read path traversal PoC. Documentation indicates the exploit was reproduced only in an isolated Docker lab and required Apache configuration adjustments to move past an initial HTTP 403 state. Overall, the repository is a legitimate, basic proof-of-concept focused on verifying vulnerable behavior and documenting the lab setup and impact.

Repository is a small portfolio-style collection of two security lab writeups, not a source-code exploit project. It contains 3 Markdown files: a top-level README plus two subdirectories, one documenting exploitation of CVE-2021-41773 in Apache HTTP Server 2.4.49 and one documenting Wazuh SIEM deployment and SSH brute-force detection. The exploit-relevant content is entirely in cve-2021-41773-apache/README.md. The Apache writeup describes a reproducible proof-of-concept for CVE-2021-41773. It explains how to build vulnerable Apache 2.4.49 from source with mod_cgid enabled, start the service, and exploit the path traversal sequence '/.%2e/.%2e/.%2e/.%2e/' to escape from /cgi-bin/ to /bin/sh. The documented curl and PowerShell examples send POST data containing shell commands prefixed with a Content-Type header, yielding arbitrary command execution as the Apache user. Demonstrated capabilities include reading /etc/passwd and executing commands such as lscpu and ps aux. The writeup also documents mitigations: restoring '<Directory /> Require all denied' and disabling mod_cgid. There is no standalone exploit script in the repository; the exploit logic is embedded as command examples and a short PowerShell helper function 'Send-RCE' inside the README. Because the repository is documentation-heavy and lacks packaged tooling, the maturity is best classified as POC rather than operationalized malware or framework content. The second subdirectory, wazuh-siem-deployment, is unrelated to exploitation. It documents SIEM installation, custom Wazuh detection rules, index templates, ports, and dashboard usage. It includes several network-relevant observables but functions as defensive deployment documentation rather than exploit code.

This repository is a small self-contained lab for reproducing CVE-2021-41773 against Apache HTTP Server 2.4.49. It contains a Dockerized vulnerable Apache instance and a Python proof-of-concept exploit. The main exploit logic is in exploit/exploit.py, which validates that the target is local-only, builds a traversal path using encoded dot segments under /cgi-bin/, opens a raw TCP socket, sends a handcrafted HTTP GET request, and checks the response for both HTTP 200 and the expected lab marker string. Its capability is controlled file disclosure, not code execution. Repository structure: README.md documents setup, exploitation, and mitigation; docker/Dockerfile builds from httpd:2.4.49 and installs a custom Apache config plus a proof file; docker/httpd-vulnerable.conf defines the Alias /cgi-bin/ mapping and permissive directory access needed for the lab; docker/secret.txt is the controlled disclosure target; exploit/exploit.py is the PoC; report/report-outline.md is documentation scaffolding; requirements.txt confirms no third-party dependencies. The exploit is a genuine PoC rather than a detection-only script. It is intentionally safety-restricted to localhost/127.0.0.1/::1 and defaults to http://127.0.0.1:8080 with /lab/secret.txt as the proof target. The overall purpose of the repository is educational reproduction of Apache path traversal/file disclosure in an isolated environment.

This repository is not a standalone exploit script but an infrastructure/provisioning lab that builds a vulnerable Apache HTTP Server 2.4.49 target and a separate attacker workstation for practicing exploitation of CVE-2021-41773. The structure is small: a top-level topology.yml defines a two-host network (server at 10.7.20.5 and client at 10.7.30.5) connected by a router, while provisioning/playbook.yml applies Ansible roles to configure the target and attacker systems. The server role is the core of the repository. It removes distro Apache packages, downloads Apache 2.4.49 from archive.apache.org, compiles it into /usr/local/apache2, enables mod_cgi/mod_cgid, weakens the root Directory policy from 'Require all denied' to 'Require all granted', and exposes a CGI directory. It also creates a test CGI script and plants multiple flags in web-accessible, filesystem-only, CGI, and root-only locations. These changes intentionally reproduce the conditions needed for the Apache 2.4.49 path traversal vulnerability and CGI-assisted remote command execution. The included access_log demonstrates realistic reconnaissance and exploitation traffic, including GET requests for /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd and POST requests to /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh. The client role prepares an attacker VM with common tooling such as curl, wget, netcat, nmap, gobuster, python3, and a large web content wordlist copied to /home/student/dict_common.txt. This supports enumeration and exploitation from the attacker side but does not itself contain exploit automation. Main exploit capabilities represented by the lab are: reconnaissance of exposed web content, arbitrary file read via traversal outside the document root, and remote command execution by invoking /bin/sh through the CGI path. Because the repository provisions the vulnerable service and demonstrates the attack paths rather than shipping a reusable exploit program, its maturity is best described as OPERATIONAL: the payload path and exploitation method are explicit and functional, but payload customization/automation is minimal.

This repository is a self-contained CVE-2021-41773 lab and exploit package targeting Apache HTTP Server 2.4.49. Its main executable component is CVE-2021-41773/exploit_framework.py, a Python PoC that performs a banner-grab safety check, constructs encoded traversal paths using /.%2e segments, reads arbitrary files via alias-based traversal, and can escalate to unauthenticated RCE by POSTing commands to a traversed CGI executable such as /bin/sh. The exploit is operational rather than framework-based: it includes working payload logic and basic target validation, but not a modular payload ecosystem. Repository structure: config/httpd_vuln.conf defines the intentionally insecure Apache configuration, notably permissive root directory access and ScriptAlias /cgi-bin/ to enable the CGI/RCE variant. config/vulnerable_apache2.4.49_dockerfile.conf builds an Apache 2.4.49 Docker image, enables mod_cgi, includes the vulnerable vhost config, and creates a test CGI script. docker_compose.yml exposes the lab on localhost:8080 and mounts logs. The docs directory contains setup instructions, configuration rationale, and a detailed root-cause analysis of the normalization flaw. payloads/payloads.txt catalogs working and failing traversal/RCE payload variants and interesting file targets. Main exploit capabilities: (1) fingerprinting via HTTP HEAD and Server header inspection for Apache/2.4.49; (2) arbitrary file read using paths like /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd; and (3) command execution through CGI by traversing to /bin/sh and sending a POST body such as 'echo; id'. The exploit assumes a vulnerable alias path and, for RCE, mod_cgi enabled. Overall, this is a legitimate educational exploit repository with both vulnerable-environment provisioning and a Python exploit script for demonstrating path traversal and CGI-based RCE.

This repository is a small educational Python/FastAPI lab that demonstrates a web-based path traversal / local file inclusion flaw modeled after Apache HTTP Server CVE-2021-41773 and CVE-2021-42013. It is not a full offensive exploit toolkit; instead, it contains both a deliberately vulnerable implementation and a patched implementation to show the bug and the fix side by side. Repository structure: 7 files total, with 2 Python code files as the main logic. vulnerable_app.py is the primary vulnerable example and likely the main entry point for exploitation. patched_app.py is the secure comparison implementation. README.md documents setup, curl payloads, and expected behavior. secret.txt is the sensitive file placed outside the webroot to prove traversal. webroot/test.txt is a benign in-bounds file used for baseline testing. Main exploit capability: vulnerable_app.py exposes a FastAPI route /icons/{path:path} that URL-decodes attacker-controlled input and joins it with WEBROOT, but does not canonicalize the resulting path or enforce that the final resolved path remains inside webroot. This allows traversal-style requests such as .%2e and .%252e sequences to access files outside the intended directory. The included proof-of-concept target is secret.txt, demonstrating arbitrary file read/LFI. Exploit flow: the attacker sends crafted HTTP GET requests to /icons/... using curl with --path-as-is so the client does not normalize the path first. The vulnerable server decodes the path and passes the resulting filesystem path to os.path.isfile() and FileResponse(), enabling out-of-bounds file retrieval if the referenced file exists. Patched behavior: patched_app.py recursively URL-decodes the path, resolves it with os.path.realpath(), computes the canonical webroot path, and rejects requests whose resolved path escapes the authorized directory. This blocks both single-encoded and double-encoded traversal attempts with HTTP 403. Overall, this is a legitimate proof-of-concept lab for demonstrating and testing path traversal/LFI behavior in a controlled local environment.

This repository is a small self-contained exploit lab for CVE-2021-41773 targeting Apache HTTP Server 2.4.49. It contains three files: a detailed README explaining the vulnerability and reproduction steps, a docker-compose.yml that provisions a deliberately vulnerable Apache container, and exploit.sh which automates the proof-of-concept requests with curl. The exploit capability is two-stage. First, it abuses encoded path traversal sequences such as '.%2e/' and '%2e%2e/' with curl's '--path-as-is' option to prevent client-side normalization, allowing arbitrary file read outside the document root. The demonstrated target is /etc/passwd via the /icons/ alias. Second, when CGI is enabled, it escalates to remote code execution by traversing through /cgi-bin/ to /bin/sh and supplying shell commands in the POST body; the included payload runs 'id'. The Docker Compose file is important to understanding the exploit conditions: it pins the image to httpd:2.4.49, changes Apache's root directory policy from 'Require all denied' to 'Require all granted', enables autoindex config, and loads mod_cgid. This intentionally creates both the file-read and RCE conditions described in the README. The service is exposed locally on http://localhost:8080. Overall, this is a real exploit PoC rather than a scanner or detection script. It is operational but basic: the payloads are hardcoded for local lab reproduction, with no target discovery, no evasion, and no generalized command interface beyond the demonstrated curl requests.

This repository is a minimal lab/PoC for CVE-2021-41773 rather than a full exploit toolkit. It contains three files: a `Dockerfile` that builds a vulnerable Apache HTTP Server 2.4.49 container, `vulnerable.conf` that intentionally weakens Apache access controls and exposes an aliased directory, and `Readme.md` that explains the bug and shows how to trigger it with `curl --path-as-is`. There is no standalone exploit script; the exploit capability is delivered as a crafted HTTP request path using encoded traversal segments such as `.%2e` to bypass Apache 2.4.49 path normalization checks. The main purpose of the repo is to reproduce and demonstrate arbitrary file read against a deliberately vulnerable Apache instance. The exploit path shown is `/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd`, targeting the aliased `/icons/` location to escape to the filesystem root and read `/etc/passwd`. The repository is operationally simple and educational: it sets up the vulnerable environment and documents exploitation, but does not include automation, post-exploitation, or customizable payload logic.

Repository is a small standalone Python exploit PoC for CVE-2021-41773 against Apache HTTP Server 2.4.49. Structure is minimal: README.md documents usage and intent, requirements.txt lists the single dependency (requests), and exploit.py contains all exploit logic. The script is not part of a larger framework. The exploit works by constructing a crafted CGI traversal path ending in /bin/sh: /cgi-bin/.%2e/%2e%2e/.../bin/sh. It first normalizes the supplied target, then attempts protocol detection by sending a GET request to http://<target> and checking for HTTPS redirects or SSL behavior. For exploitation, it sends a POST request to the traversal path with a shell payload formatted as 'echo Content-Type: text/plain; echo; <cmd>', which causes command output to be returned in the HTTP response if the target is vulnerable. Capabilities include: (1) vulnerability verification using a benign 'echo VULNERABLE' command, (2) one-shot arbitrary command execution via the -c option, and (3) an interactive pseudo-shell loop for repeated command execution. Verbose mode prints request URL, payload, method, status code, timing, response length, and headers. This is a real exploit rather than a detector-only script because it contains working remote command execution functionality. It is best classified as OPERATIONAL: the payload is basic and hardcoded around shell command execution, but it is sufficient for practical exploitation of exposed vulnerable targets.

This repository is a small standalone Python exploit set for Apache HTTP Server CVE-2021-41773. It contains three executable scripts and one README. The code is not part of a larger exploit framework. Repository structure: README.md documents usage and references; cve-2021-41773.py is a mass scanner for path traversal/file read; cve-2021-41773_RCE.py is a mass RCE checker; cve-2021-41773_manual.py is an interactive single-target command execution tool. Main capabilities: The first script builds HTTP GET requests against several common web directories (/cgi-bin, /assets, /icons, /uploads, /img, /image) and appends a traversal sequence ending in /etc/passwd. It treats the presence of 'root:x:' in the response as proof of vulnerability and logs hits to vuln.txt. The second script targets a traversal path to /bin/sh under /cgi-bin and sends a POST body of 'echo; uname'; if the response is 'Linux' or 'linux', it marks the host vulnerable and logs it. The third script uses the same /bin/sh traversal endpoint but allows the operator to repeatedly enter arbitrary commands for a chosen target, effectively providing an interactive command execution interface. Operational notes: All scripts force HTTP rather than HTTPS when constructing exploit URLs, disable TLS verification warnings, and use Python requests. The mass scripts support concurrency via multiprocessing.dummy.Pool. The exploit logic assumes Linux targets because it checks /etc/passwd and invokes /bin/sh. Overall, this is an operational exploit toolkit combining detection, mass exploitation checks, and manual post-exploitation command execution for vulnerable Apache servers.

Small standalone Python proof-of-concept exploit for CVE-2021-41773 targeting Apache HTTP Server 2.4.49. The repository contains only a brief README and one executable script, greendark.py. The script takes three arguments: target, port, and command. It constructs an HTTP POST request to a crafted path under /hospital-cgi/ using URL-encoded dot segments to traverse directories and reach /bin/sh, then sends a CGI-style body that echoes a content type header followed by the attacker-supplied shell command. If exploitation succeeds, the script prints the command output from the response body. There is no scanning, brute force, persistence, or post-exploitation automation; it is a direct remote command execution PoC with a user-controlled payload.

Small standalone exploit repository with 2 files: one Python exploit script and one README. The main file, CVE-2021-41773.py, is an interactive Apache 2.4.49 RCE exploit for CVE-2021-41773. It prompts the operator for a target URL, appends a traversal payload targeting /cgi-bin/.../bin/sh using double-percent encoding (.%%32%65 sequences), and repeatedly accepts shell commands from stdin. Each command is wrapped into a POST body that emits a plain-text CGI header and then executes the supplied shell command. The script disables TLS certificate verification, suppresses urllib3 insecure-request warnings, sets a browser-like User-Agent, uses a 10-second timeout, and disables redirects. Response handling is geared toward exploitation feedback: 200 prints command output, while 403/404/500 and redirect codes produce diagnostic messages. The exploit is operational rather than just a detector because it attempts direct command execution and provides an interactive loop. The README documents the vulnerability mechanics, intended use, and dependencies, but the repository itself is minimal and focused entirely on exploiting Apache HTTP Server 2.4.49 instances with CGI enabled and vulnerable path normalization.

This repository is a small proof-of-concept lab for CVE-2021-41773 affecting Apache HTTP Server. It is not an automated exploit tool; instead, it provides documentation plus a Dockerized vulnerable environment that can be used to reproduce unauthenticated path traversal and remote command execution. The repository contains three files: a README describing the vulnerability and manual exploitation steps, a custom Apache httpd.conf enabling the vulnerable conditions, and a docker-compose.yml that launches httpd:2.4.49 with the custom configuration. The exploit capability demonstrated is web-based RCE through a crafted CGI traversal request. The README shows a curl command using --path-as-is and an encoded traversal sequence under /cgi-bin/ to reach /bin/sh, then posts shell commands that print a CGI header and execute id and uname -a. This confirms arbitrary command execution as the Apache daemon user when CGI is enabled and exposed through ScriptAlias. The configuration file is important to the exploit: it loads mod_cgi and mod_alias, maps /cgi-bin/ to /usr/local/apache2/cgi-bin/, and enables ExecCGI. The Docker Compose file exposes the service on localhost:8080 and mounts the custom config and CGI directory. Overall, the repository’s purpose is to recreate the vulnerable Apache setup and manually demonstrate the CVE-2021-41773 attack path rather than provide a standalone exploit program.

This repository is a self-contained Docker lab and PoC for CVE-2021-41773 affecting Apache HTTP Server 2.4.49. It is not tied to a major exploit framework. The repository contains a vulnerable Apache build environment (dockerfile), runtime orchestration (docker-compose.yml), a deliberately insecure Apache configuration (apache/httpd.conf), a Bash PoC (scripts/poc.sh), and a simple landing page (web/index.html). The exploit capability is twofold: first, path traversal using encoded dot segments against an Alias path (/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd) to read arbitrary files; second, remote command execution when CGI is enabled by traversing from /cgi-bin/ to /bin/sh and POSTing shell commands. The Apache config is intentionally permissive: it enables mod_alias and mod_cgi, defines Alias /icons/ and ScriptAlias /cgi-bin/, grants access to '/', and runs as daemon. The Bash PoC defaults to http://localhost:8080 and performs three steps: service check, /etc/passwd disclosure, and CGI-based execution of id. Overall, this is an operational lab-grade exploit repository demonstrating both information disclosure and RCE paths for CVE-2021-41773 under specific vulnerable configuration conditions.

Repository is a small self-contained lab and PoC for Apache HTTP Server CVE-2021-42013, demonstrating unauthenticated path traversal leading to arbitrary file read and CGI-based remote command execution. Structure: README.md and EXPLAIN.md provide detailed Korean-language vulnerability explanation, exploitation rationale, and usage instructions; docker-compose.yml launches a vulnerable httpd:2.4.50 container on localhost:8080; httpd.conf supplies the Apache configuration needed for the vulnerable scenario; poc.py and poc.sh are the practical exploit entry points. The exploit logic is straightforward: repeat the double-encoded traversal segment '%%32%65%%32%65/' four times to escape the web root, then request '/etc/passwd' through an Alias-like path ('/static/') or invoke '/bin/sh' through a ScriptAlias-like CGI path ('/cgi-bin/') with a POST body containing shell commands. This is an operational PoC rather than a framework module: it includes a working payload and a reproducible Docker environment, but payload customization is minimal. Notable findings: the Python PoC appears partially truncated/corrupted in the provided content around the Content-Type header assignment, but the intended exploit flow is still clear from surrounding code and the shell PoC. The repository is clearly malicious-capable exploit code, not merely detection, because it actively performs exploitation and returns sensitive file contents and command output.

This repository is a small standalone proof-of-concept for CVE-2021-41773 affecting Apache HTTP Server 2.4.49. It contains two files: a single Python exploit script (PoC_2021-41773.py) and a README with vulnerability background, setup notes, and usage examples. The Python script is the only code file and serves as the clear entry point. The exploit has two primary capabilities. First, in 'traversal' mode it performs arbitrary file read by constructing a URL path using mixed-encoded traversal segments '.%2e/' repeated four times, then appending a target file path. The hardcoded validation target is /etc/passwd. Second, in 'rce' mode it targets '/cgi-bin/' and traverses to '/bin/sh', then sends a POST body containing a minimal shell CGI script that emits a valid Content-Type header and executes an operator-supplied command, returning stdout/stderr in the HTTP response. This makes it a real exploit, not merely a detector. The exploit uses urllib3 directly, likely to avoid automatic URL re-encoding that would break the traversal payload. It disables SSL certificate warnings and accepts a user-provided base URL via --target. The script supports two modes via CLI arguments: '--mode traversal' and '--mode rce', with '--cmd' defaulting to 'id' for command execution. Operational assumptions are important: the target must be Apache 2.4.49, traversal must be reachable through permissive access control such as 'Require all granted', and mod_cgi must be enabled for RCE. The code specifically assumes the presence of '/traversal/' for file-read testing and '/cgi-bin/' for CGI execution. Overall, this is an operational PoC demonstrating both arbitrary file disclosure and remote command execution against a vulnerable Apache deployment.

Small standalone Bash exploit repository for CVE-2021-41773 targeting Apache HTTP Server 2.4.49. The repository contains only three files: an MIT LICENSE, a short README with usage instructions and an example showing command execution as www-data, and the main exploit script exploit.sh. The script is the sole code file and acts as the entry point. It accepts a single target IP, constructs a crafted HTTP URL pointing to /cgi-bin with repeated encoded traversal segments ending in /bin/bash, and then enters an interactive loop. Each operator-entered command is sent via curl as an HTTP POST body prefixed with 'echo; ', enabling remote command execution if the target is vulnerable and CGI/bash execution is exposed. This is a real exploit rather than a detector: it does not verify vulnerability safely first, and it directly attempts exploitation to obtain shell-like command execution. The code is minimal and operational, but not highly flexible or framework-integrated.

This repository is a small standalone Python exploit for Apache HTTP Server 2.4.49 path traversal and RCE, targeting CVE-2021-41773. The repo contains one executable script, CVE-2021-41773.py, and a README describing the vulnerability and usage. The script is interactive: it prompts for a target base URL, appends a crafted traversal payload (/cgi-bin/.%%32%65/.../bin/sh), then repeatedly prompts the operator for commands to execute. Each command is wrapped in a simple shell payload (echo Content-Type header, blank line, then the command) and sent via HTTP POST to the target path. If successful, the script prints the response body as command output. It disables TLS certificate verification, suppresses urllib3 insecure-request warnings, sets a browser-like User-Agent, and handles common HTTP status codes (200, 403, 404, 500, redirects) with operator-friendly messages. The exploit is not merely a detector; it attempts real command execution against vulnerable servers. There is no modular framework, no scanning engine, and no customizable staged payload beyond arbitrary operator-supplied shell commands, so it is best classified as an operational standalone exploit/PoC.

This repository is a small self-contained reproduction and exploit demonstration for CVE-2021-41773 affecting Apache HTTP Server 2.4.49. It contains three files: a Dockerfile that builds a deliberately vulnerable Apache environment, a short README with execution steps, and a Bash script that automates environment setup and exploitation. The Dockerfile uses the vulnerable base image 'httpd:2.4.49', creates a fake sensitive file at /etc/secret_credential.txt, enables CGI support by uncommenting cgid_module and cgi_module in /usr/local/apache2/conf/httpd.conf, and weakens the default directory protection by replacing 'Require all denied' with 'Require all granted'. This configuration is important because the exploit chain relies on both the path traversal bug and permissive server configuration to reach /bin/sh through the CGI mechanism. The main exploit logic is in exploit.sh. It first stops and removes any prior Docker container, builds the vulnerable image, and launches it locally with port mapping 8080:80. After a short delay, it performs two POST requests with curl using '--path-as-is' to preserve the traversal sequence. Both requests target the traversal path '/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'. The first sends shell commands that emit a CGI content type header and then read /etc/secret_credential.txt, demonstrating arbitrary file disclosure. The second sends commands to run 'id', demonstrating remote code execution. This is a real exploit demonstration rather than a detector. It is operational but basic: payloads are hardcoded and intended for local lab reproduction, not generalized exploitation. The attack vector is web/network-based, and the exploit’s purpose is educational reproduction of the Apache 2.4.49 traversal-to-RCE chain under a permissive CGI-enabled configuration.

This repository is a self-contained Docker attack-emulation lab rather than a single standalone exploit. It implements an operational multi-stage kill chain centered on two real vulnerabilities: CVE-2017-5638 against Apache Struts 2.3.28 for initial foothold, and CVE-2021-41773 against Apache HTTP Server 2.4.49 for path traversal and RCE on the final target. The repository structure is organized into: (1) attacker/exploits/, containing Bash scripts for recon, direct exploitation, foothold establishment, pivoting, and full-chain orchestration; (2) docker-compose.yml, which defines the lab topology with attacker, vulnerable targets, supporting infrastructure, and two Suricata IDS sidecars; (3) scripts/, which provide setup, attack dispatch, alert tailing, and teardown; and (4) Dockerfiles for the attacker, vulnerable web server, Struts host, and Suricata sensors. Main exploit capabilities: recon.sh performs ICMP sweep, TCP connect scans, service fingerprinting, HTTP HEAD banner grabs, and SSH probing across the 172.28.0.0/24 lab subnet. foothold_struts.sh delivers an OGNL injection in the Content-Type header to exploit Struts S2-045 and execute arbitrary shell commands via /bin/bash -c. exploit_cve_2021_41773.sh directly attacks Apache httpd 2.4.49 by first reading /etc/passwd through encoded traversal and then POSTing commands to /bin/sh through the vulnerable cgi-bin path, checking for uid=0 to indicate root compromise. pivot_struts_to_web.sh is the most notable lateral movement component: it uses the Struts RCE to run a base64-decoded Bash script on the compromised web-struts host, which then opens a raw TCP socket with /dev/tcp to web-vuln:80 and sends the CVE-2021-41773 exploit request from an internal source. Optional legacy scripts foothold_ssh.sh and pivot_attack.sh simulate credential abuse and SSH-based pivoting using sshpass. The exploit is real and functional within the intended lab. It is not merely a detector, although the repository also includes Suricata rules to observe the attack. The payloads are basic but operational Bash command-execution payloads, with hardcoded defaults and user-supplied command support. The web-vuln Dockerfile explicitly enables mod_cgi in Apache so the CVE-2021-41773 RCE path works. Overall, the repository’s purpose is to emulate attacker behavior and defender telemetry across a realistic multi-host environment, especially to demonstrate how initial access on one host can be chained into internal lateral movement and final compromise on another host.

This repository is a small standalone Python exploit for CVE-2021-41773 affecting Apache HTTP Server 2.4.49. It contains two files: a minimal README with an NVD reference and screenshot, and a single executable script, exp.py, which implements the exploit logic. The script has two main capabilities. First, check_vuln() performs vulnerability detection against one or more targets by sending a POST request to a crafted traversal path under /cgi-bin/ that resolves to /bin/sh. It submits the payload 'echo Content-Type: text/plain; echo; echo VULNERABLE' and checks the response body for the marker string 'VULNERABLE'. Second, runcmd() provides an interactive command execution loop for a single target. It first probes the base URL to determine whether HTTP or HTTPS is in use, then repeatedly sends user-supplied shell commands in POST data to the same traversal endpoint, printing the command output returned by the server. Repository structure is simple and purpose-built: exp.py is the only code file and clear entry point, using argparse for CLI handling and requests for HTTP communication. The -l/--list option reads a local file of targets and runs detection only; the -t/--target option launches the interactive RCE mode. The exploit disables TLS verification warnings and uses short timeouts, indicating practical offensive use rather than just documentation. Overall, this is an operational PoC exploit that supports both scanning and exploitation of vulnerable Apache 2.4.49 servers exposing the CGI traversal condition.

This repository is a small, self-contained proof-of-concept for CVE-2021-41773 affecting Apache HTTP Server 2.4.49. It contains three files: a Python exploit script, a lab setup description, and a README. The main functionality resides entirely in CVE-2021-41773-exploit.py. The exploit is a network-based Python PoC that accepts a target base URL from the command line, defaulting to http://localhost. It first performs a lightweight check by requesting /cgi-bin/test.sh and inspecting the Server response header for '2.4.49'. If the version check appears positive, it sends a POST request to /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh, using the Apache 2.4.49 path traversal flaw to reach /bin/sh. The POST body prepends a CGI content-type header and then executes arbitrary shell commands. The script demonstrates this capability with 'id', 'whoami', 'uname -a', and 'cat /etc/passwd', showing both command execution and file disclosure. Repository structure and purpose: - CVE-2021-41773-exploit.py: primary exploit code and likely entry point. - LabSetup.txt: documents the intended vulnerable lab, including Ubuntu, Apache 2.4.49 compiled from source, mod_cgi enabled, permissive 'Require all granted' configuration, and example attacker/victim IPs. - README.md: high-level description and disclaimer. This is not a framework module and not merely a detector; it is a working PoC exploit with a basic hardcoded demonstration payload. It is best classified as OPERATIONAL rather than WEAPONIZED because it supports arbitrary command execution but lacks framework integration, payload management, or advanced operator features.

This repository is a small, self-contained proof-of-concept for CVE-2021-41773 affecting Apache HTTP Server 2.4.49. It contains four files: a Python exploit (exploit.py), a Dockerfile that builds an intentionally vulnerable Apache 2.4.49 lab environment, and two Markdown documents (README.md and SETUP.md) describing the vulnerability, setup, and expected behavior. The main exploit logic is in exploit.py. It uses Python raw TCP sockets instead of higher-level HTTP libraries specifically to preserve the encoded traversal sequence '%2e', which many libraries normalize and thereby break. The script first checks target reachability with a GET / request, then performs a path traversal request to '/.%2e/.%2e/.%2e/.%2e/etc/passwd', and finally attempts remote code execution by POSTing to '/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'. The POST body is a simple shell payload that emits a CGI content type header and then runs an arbitrary command. In its default flow, it executes 'id', 'whoami', 'hostname', and 'cat /etc/os-release | head -3'. The exploit’s capabilities are therefore: unauthenticated file disclosure via path traversal and unauthenticated command execution via CGI-enabled traversal to /bin/sh. The payload is basic but functional, making the exploit operational rather than merely demonstrative. The Dockerfile is important context: it uses httpd:2.4.49, enables mod_cgi, allows filesystem-wide access with 'Require all granted' on '/', enables CGI execution, and creates a test CGI script. This configuration is intentionally unsafe and designed to make the RCE path work reliably in a lab. The documentation reinforces that the intended target is a local Docker container exposed on port 8080. Overall, this is a genuine exploit repository, not a scanner or detection script. It is narrowly focused on reproducing CVE-2021-41773 in a controlled environment and demonstrates both traversal and RCE against Apache 2.4.49.

This repository is a small standalone proof-of-concept exploit project for CVE-2021-41773 affecting Apache HTTP Server 2.4.49. The main exploit logic is in poc_41773.py, a Python script that uses requests and argparse to target a user-supplied base URL. It implements two capabilities: arbitrary file read by appending a traversal sequence (/cgi-bin/.%2e/.%2e/.%2e/.%2e) to a requested file path, and remote command execution by POSTing shell commands to the traversed /bin/sh path. The script is operational rather than a mere detector because it actively retrieves file contents and executes attacker-supplied commands. Repository structure is simple: README.md documents the vulnerability, lab setup, and example exploitation commands; docker-compose.yml defines a local lab with a vulnerable Apache container on port 8080 plus two unrelated vulnerable containers for other CVEs; offensive_zeta_shell.txt is a captured terminal log showing a successful reverse shell session from the Apache container as user daemon; and .gitignore contains standard exclusions. The exploit is not part of a larger framework such as Metasploit or Nuclei. The primary network target pattern is an HTTP service exposing Apache 2.4.49 with vulnerable path normalization and, for RCE, CGI enabled. The most fingerprintable exploit endpoint is the traversal path under /cgi-bin leading to /bin/sh. The README demonstrates local lab exploitation against http://localhost:8080 and includes a sample reverse shell callback to 192.168.56.1:4444. Overall, the repository’s purpose is to demonstrate and validate path traversal and command execution against a deliberately vulnerable Apache lab instance.

This repository is a small self-contained lab and proof-of-concept exploit for CVE-2021-41773, the Apache HTTP Server 2.4.49 path traversal vulnerability. It contains three files: a README with setup and usage instructions, a Bash script to launch or stop a vulnerable Dockerized Apache instance, and a Python exploit script. The main exploit capability is arbitrary file read via a crafted traversal request to /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd. The Python script uses a raw TCP socket to connect to a user-supplied host and port, sends a manual HTTP GET request, collects the full response, and checks for 'root:x:' to determine likely success. It then prints up to the first 2000 bytes of the response. There is no remote code execution payload, persistence, or post-exploitation logic; this is a straightforward file-disclosure PoC. Repository structure and purpose: - README.md: Documents cloning, starting the lab, manual exploitation with curl, automated exploitation with exploit.py, and stopping the lab. - apache_lab.sh: Creates a reproducible vulnerable environment by pulling Docker image httpd:2.4.49, running it as container 'apache-vuln', exposing it on localhost:8080, and modifying /usr/local/apache2/conf/httpd.conf to replace 'Require all denied' with 'Require all granted', then restarting Apache. - exploit.py: Interactive exploit PoC that targets a specified IP/port and attempts to read /etc/passwd. This is a real exploit repository rather than a detection-only script, but its maturity is best classified as POC because it demonstrates a single hardcoded traversal payload and only validates success by checking for passwd contents.

Small single-script Python exploit repository targeting Apache HTTP Server path traversal/RCE vulnerabilities CVE-2021-41773 and CVE-2021-42013. The repository contains only four files: a standard .gitignore, GPL license, a minimal README naming the Apache CVE, and the main exploit script exploit.py. The exploit script is the only code file and serves as the entry point. The script accepts four command-line arguments: target host, target port, attacker IP, and attacker port. It constructs an HTTP URL pointing to a traversal path under /cgi-bin/ that resolves to /bin/bash on the target: /cgi-bin/.%2e/.../bin/bash. It then sends a POST request using the local curl binary via subprocess.run, with a payload that prints a CGI header and launches an interactive bash reverse shell to the attacker using /dev/tcp. This makes the exploit an active RCE exploit rather than a detector. Operationally, the exploit depends on a vulnerable Apache configuration where CGI execution is reachable and the traversal flaw can be used to execute /bin/bash. It also assumes a Unix-like target with bash available and outbound network access from the victim to the attacker listener. There is no target validation, no vulnerability check, no payload customization beyond command-line callback parameters, and no error handling beyond catching subprocess exceptions. Overall, this is a straightforward proof-of-concept/operational reverse-shell exploit for vulnerable Apache 2.4.49/2.4.50 deployments.

Repository purpose: a modular Python-based LFI exploitation framework (“LFI-Destruction v5.2”) intended for authorized penetration testing. It targets generic LFI primitives in web apps and chains them into file disclosure, credential harvesting, and multiple LFI→RCE techniques. Structure & key files: - LFI-Destruction.py: main entry point and core engine. Implements interactive configuration (target URL, LFI type path vs param, traversal depth, encoding, headers/cookies/proxy, OS selection) and runs Mode 1 & Mode 2 directly. Also dynamically loads additional modes (3–5) from separate Python modules. - mode3_phpinfo_race.py: Mode 3 (beta) automates discovery of phpinfo() endpoints using OS-specific path wordlists, parses phpinfo output for upload constraints, then attempts a classic upload temp-file race to obtain a temporary filename (e.g., /tmp/phpXXXX or C:/Windows/Temp/phpXXXX.tmp) and includes it via LFI to execute a PHP payload; on success it can proceed to a reverse shell. - mode4_upload_trigger.py: Mode 4 (beta) attempts to include an already-uploaded PHP webshell via LFI. Supports a single operator-provided path or brute-force of common upload locations; verifies execution via ?cmd=id/whoami and can then attempt a reverse shell. - mode5_session_grabber.py: Mode 5 (beta) attempts to locate PHP session.save_path (fallback wordlists for Linux/Windows), optionally enumerate session files via directory listing, download sess_* files via LFI, and attempt php://filter/convert.base64-decode to recover readable session contents for hijacking. - encoding_patterns.json / headers.json / user_agents.txt / cookies.txt / proxies.txt: supporting data for traversal/encoding variants, header profiles (including spoofed client IP headers), and operator convenience for authenticated testing and proxying. - install_dependencies.sh: installs colorama (and optionally requests/bs4/urllib3) and creates local directories (artifacts, etc.). Exploit capabilities (by mode): 1) Artifact fuzzing / file disclosure: enumerates likely user directories (Linux/Windows) and attempts to retrieve sensitive files via LFI (SSH keys, browser credential stores, cloud credentials, etc.), saving results under ./artifacts/. 2) Log poisoning → RCE: injects PHP into log sinks via configurable vectors (User-Agent/Referer/XFF/custom header/parameter), then includes candidate log files via LFI to execute system($_GET['cmd']); validates with a test command and can deliver a reverse shell (bash or PowerShell) including a customizable command template. 3) phpinfo() race LFI2RCE: finds phpinfo(), confirms file_uploads and size constraints, races to capture the upload tmp_name and includes it via LFI to execute PHP payload; then offers reverse shell. 4) Uploaded file trigger: includes an existing webshell via LFI and executes commands via ?cmd=. 5) Session grabbing: reads and optionally enumerates PHP session files to facilitate session hijacking; attempts base64 decode wrapper bypass. Notable observables: the repo includes example target URLs (192.168.1.100 and target.com:8443) and many local filesystem paths used as LFI targets (session directories, upload locations, PHP temp paths). No hardcoded attacker C2 is present; reverse shell destinations are operator-supplied at runtime.

Repository purpose: a self-contained Docker lab and Python PoC exploit for Apache HTTP Server 2.4.49 CVE-2021-41773 (path traversal leading to file read and, when CGI is enabled, RCE). Key exploit capabilities (exploit.py): - Sends non-normalized raw HTTP requests using Python stdlib http.client to preserve encoded traversal sequences (.%2e). - Vulnerability check: POST to /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh and reads /etc/passwd to confirm exposure. - Arbitrary file read: runs `cat <filepath>` via /bin/sh. - RCE: executes arbitrary shell commands supplied via -c. - Interactive pseudo-shell: repeatedly issues separate HTTP requests to execute commands. Lab environment structure: - docker-compose.yml defines three services: nginx reverse proxy (80:80), vulnerable apache (8888:80), and mysql:5.7 on a backend network. It intentionally includes insecure practices (containers run as root, secrets in environment variables). - apache/Dockerfile pins httpd:2.4.49 and enables mod_cgi/mod_cgid; installs mysql-client for post-exploitation/pivot demonstration. - apache/httpd.conf is intentionally vulnerable: <Directory /> Require all granted and ScriptAlias /cgi-bin/ with ExecCGI enabled. - nginx/nginx.conf proxies to Apache using proxy_pass http://apache_backend$request_uri to pass the raw URI (helping the encoded traversal reach Apache) and leaks version via server_tokens on. - mysql/init.sql seeds demo data and grants root access from any host ('root'@'%') with a known password; includes example “sensitive” values. Overall, this is an operational PoC exploit plus a reproducible vulnerable stack to demonstrate unauthenticated traversal-to-RCE, secret extraction from container environments (e.g., /proc/1/environ), and potential pivoting to MySQL using exposed credentials.

Repository purpose: a Python-based interactive LFI/path traversal fuzzer focused on discovering and exfiltrating SSH artifacts from a vulnerable web server via file-read primitives. Key files and structure (11 files): - LFI-SSH-FUZZER.py: main tool. Implements an interactive scanner with options for advanced mode, user-agent rotation, rate limiting, proxy support, custom headers, cookie handling, timeouts, traversal depth, and redirect handling. It targets two LFI styles: (1) path-segment traversal and (2) query-parameter LFI. It confirms LFI by reading /etc/passwd, parses usernames, then attempts to locate and download SSH-related files for those users. - encoding_patterns.json: database of traversal encodings/obfuscations, including Apache-specific patterns for CVE-2021-41773 and CVE-2021-42013, plus PHP wrapper examples (php://filter, data://). - headers.json: header profiles for “bypass”/testing (X-Forwarded-For, CF headers, debug headers, etc.) to help reach internal-only routes or evade simplistic controls. - proxies.txt, cookies.txt, user_agents.txt: operator convenience lists for routing through tools (Burp/ZAP/Tor), supplying authenticated cookies, and rotating UAs. - README.md and quick_reference.md: usage notes; explicitly claims support for Apache 2.4.49/2.4.50 traversal (CVE-2021-41773) and SSH key discovery. - install_dependencies.sh: installs Python deps (colorama; optionally requests/bs4/urllib3) and creates local directories (artifacts/, config_examples/, tests/). Exploit capabilities (actionable): - Network-based exploitation of LFI/path traversal to read arbitrary local files. - Automated enumeration: reads /etc/passwd, extracts users, then hunts for SSH artifacts (keys and related files) and downloads them locally. - Bypass/fuzzing support: multiple traversal encodings (single/double/triple encoding, unicode slashes, Windows backslashes), Apache traversal variants, null-byte/wrapper patterns, and header/cookie/proxy features to operate against authenticated or filtered endpoints. No hardcoded victim infrastructure is present beyond example targets and local proxy endpoints; the actual target host/URL is provided interactively/through CLI arguments.

Repository purpose: a Python PoC/exploit helper for Apache httpd path traversal and optional CGI-based RCE affecting 2.4.49 (CVE-2021-41773) and 2.4.50 (CVE-2021-42013), plus a Docker lab to spin up a vulnerable 2.4.50 instance. Structure: - cve-2021-42013.py: main exploit script. It performs a HEAD request to the target to read the `Server` header and chooses payloads based on whether the version string contains “49” or “50”; otherwise it tries both CVEs. It supports: - Path traversal check/PoC (-pt): requests a crafted /icons/ traversal URL and considers the target vulnerable if response contains "root:". - RCE check/PoC (-rce): POSTs to a crafted /cgi-bin/ traversal URL ending in /bin/sh with body "echo;id" and considers the target vulnerable if response contains "uid=". - Bulk scanning (-l): iterates over a list of URLs. - Dockerfile: builds Apache httpd 2.4.50 from source on Ubuntu 20.04, installs it to /, copies in httpd.conf, and runs httpd in foreground. - httpd.conf: Apache configuration intended to be vulnerable for testing; README notes enabling CGI-BIN and adding an Alias for "icons" to make traversal testing possible. - README.md: usage examples and lab setup instructions. Notable implementation details/limitations: - The script is primarily a PoC/verification tool (hardcoded checks and command `id`), not a full interactive shell. - It relies on the `Server` header substring matching ("49"/"50"), which may be absent/modified; in that case it falls back to trying both payload styles. - The traversal/RCE endpoints are relative to the user-supplied base URL (e.g., http(s)://host:port + payload path).

This repository contains a working exploit for CVE-2021-41773, a path traversal and remote code execution vulnerability in Apache HTTP Server 2.4.49. The repository consists of two files: a README.md with usage instructions and vulnerability details, and exploit.py, a Python script that automates detection and exploitation. The exploit first checks if the target is vulnerable by attempting to read /etc/passwd using crafted path traversal URLs. If vulnerable, it constructs a reverse shell payload in multiple languages (bash, python, perl, php, nc, socat, telnet, zsh, awk, sh) and sends it to the target via a POST request to a path-traversed /bin/sh endpoint. Successful exploitation results in a reverse shell to the attacker's machine. The exploit is operational, providing a real payload and automating the attack process. The main attack vector is network-based, targeting HTTP(S) endpoints on the vulnerable server. The code is standalone and not part of a larger framework.

This repository contains a Python proof-of-concept exploit for CVE-2021-42013 (and references CVE-2021-41773 in the README), targeting Apache HTTP Server 2.4.49 with mod_cgi enabled. The exploit leverages a path traversal vulnerability to access the /bin/sh shell via a specially crafted URL, allowing remote, unauthenticated attackers to execute arbitrary shell commands on the server. The main script, 'CVE-2021-42013.py', provides an interactive shell-like interface, sending commands to the vulnerable endpoint using curl. The README provides background on the vulnerability, usage instructions, and example commands. No hardcoded IPs or credentials are present; the user supplies the target IP at runtime. The exploit is a functional POC and does not include advanced features or payload customization.

This repository contains a Python exploit script (CVE-2021-41773.py) and a README.md. The script targets Apache HTTP Server 2.4.49 vulnerable to CVE-2021-41773, which allows path traversal and remote code execution via crafted requests to the CGI handler. The exploit takes user input for the target IP/hostname, port, command to execute, and optionally the binary to use (default /bin/sh) and HTTPS usage. It constructs a POST request to a path-traversed CGI endpoint (e.g., /cgi-bin/.%2e/%2e%2e/.../bin/sh) with a payload that executes the supplied command. The output of the command is returned to the attacker. The README provides usage examples and describes the exploit's purpose. The repository is a straightforward, operational proof-of-concept for remote code execution against vulnerable Apache servers.