## https://sploitus.com/exploit?id=7E615961-3792-5896-94FA-1F9D494ACB36
# Exploiting CVE-2021-41773 and CVE-2021-42013
## Overview
This repository focuses on exploiting two vulnerabilities in Apache HTTPD: CVE-2021-41773 and CVE-2021-42013.
These CVEs represent path traversal vulnerabilities that can potentially lead to file mapping and remote code execution
on Apache HTTPD servers.
For in-depth information about these CVEs, including the underlying flaws, vulnerable configurations, exploits, and
more, refer to this comprehensive blog post:
[Dissecting and Exploiting CVE-2021-41773 and CVE-2021-42013](https://medium.com/@ofriouzan/dissecting-and-exploiting-cve-2021-41773-and-cve-2021-42013-7c116f489ee2).
## Requirements and Execution
To successfully exploit these vulnerabilities, you'll need:
- Python 3.7+
- Docker
To get started:
1. Clone the repository:
```
git clone https://github.com/OfriOuzan/CVE-2021-41773_CVE-2021-42013_Exploits
```
2. Build the vulnerable environments and initiate the exploits:
```
cd CVE-2021-41773_CVE-2021-42013_Exploits
python3 exploit.p
```
## Structure
### Directories
This repository comprises four distinct directories, each responsible for constructing a different container for exploitation purposes:
- **HTTPD_2_4_49_Map_Files**: Establishes a container based on Apache HTTPD 2.4.49 version, vulnerable to CVE-2021-41773 Path Traversal Map Files attack.
- **HTTPD_2_4_50_Map_Files**: Sets up a container using Apache HTTPD 2.4.50 version, vulnerable to CVE-2021-42013 Path Traversal Map Files attack.
- **HTTPD_2_4_49_RCE**: Constructs a container using Apache HTTPD 2.4.49 version, vulnerable to CVE-2021-41773 Path Traversal RCE attack.
- **HTTPD_2_4_50_RCE**: Builds a container based on Apache HTTPD 2.4.50 version, vulnerable to CVE-2021-42013 Path Traversal RCE attack.
Within each directory, you'll find a Dockerfile to facilitate container creation and a httpd.conf contains the specific
vulnerable configurations. This repository aims to provide a practical environment for understanding and studying these vulnerabilities.
### Exploit file
The exploit.py file performs the exploitation in two stages:
- **Builds the Vulnerable Environment**: It pulls the required Docker images and constructs the containers based on the information provided in the respective directories.
- **Exploits the Vulnerabilities**: It exploits the vulnerable containers with CVE-2021-41773 and CVE-2021-42013.