## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-CORELIGHT-CVE-2021-41773
# CVE-2021-41773
一个Zeek包，用于在Apache HTTP Server 2.4.49 (CVE-2021-41773)和2.4.50 (CVE-2021-42013)中检测路径遍历/远程代码执行并发出通知
参考资料
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013
https://blog.sonatype.com/apache-servers-actively-exploited-in-wild-importance-of-prompt-patching
https://corelight.com/blog/tag/corelight-labs
## 安装
`zkg install https://github.com/corelight/CVE-2021-41773/`
对已有的pcap文件使用
`zeek -Cr scripts/__load__.zeek your.pcap`
## 选项和说明：
* 此包可在集群或非集群环境中运行。
* 为了协助对PATH_TRAVERSAL_IS_VULNERABLE通知进行安全事件响应（IR）分类，'sub'字段将包含以下数据：
* 对于POST请求，通知中的前'http_body_analysis_byte_depth'字节。将其设置得较高以收集所有有效载荷——默认值1000应足够捕获分类所需的数据。要更改包含的数据量：`global http_body_analysis_byte_depth: count = 1000;`
* HTTP SERVER头部值，用于确认服务器版本。
* 原始URI，包含所有编码（在任何解码之前）。注意，默认情况下，Zeek在http.log中填充的是解码后的URI版本，而非原始发送的版本。
## 示例通知
root@kitploit:~
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path notice
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] interval string string string double double
XXXXXXXXXX.XXXXXX CT7T802QofJINCquNg 127.0.0.1 44740 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX Cj7NfN13Javpjxe831 127.0.0.1 44744 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX CIhB6g4tQcEI34f1Z7 127.0.0.1 44748 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%%32%65/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX CMmr2q3Fe2wlSS2iUh 127.0.0.1 44752 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%%32%65/.%2e/%2e%2e/.%2e/%2e%2e/%2e%2e/.%%32%65/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
#close XXXX-XX-XX-XX-XX-XX