CVE-2021-3129 PoC — Facade Ignition for Laravel 授权问题漏洞

Source

https://github.com/0x0d3ad/CVE-2021-3129

Associated Vulnerability

Title:Facade Ignition for Laravel 授权问题漏洞 (CVE-2021-3129)
Description:Facade Ignition for Laravel是比利时Facade公司的一款运行在Laravel Web框架中的可自定义的错误页面。 Ignition for Laravel 2.5.2之前版本存在授权问题漏洞，该漏洞源于程序未进行正确的身份验证，攻击者可利用该漏洞执行任意代码。

Description

CVE-2021-3129 Laravel Ignition RCE Exploit

Readme

# CVE-2021-3129 Laravel Ignition RCE Exploit

This is a Python exploit script for CVE-2021-3129, a remote code execution vulnerability in Laravel when the Ignition package is installed. This vulnerability allows an attacker to execute arbitrary system commands via PHAR deserialization.

## Features
- Automatically generates the PHAR payload using `phpggc`
- Accepts user input for any command to execute (e.g., `id`, `whoami`, etc.)
- Automates the entire exploitation process, including clearing logs, injecting the payload, converting logs to PHAR, and triggering the deserialization

## Prerequisites
- Python 3.x
- `requests` library
- PHP installed on your system
- [phpggc](https://github.com/ambionics/phpggc) installed (for generating PHAR payloads)

## Installation

1. Clone the repository:
    ```bash
    git clone https://github.com/0x0d3ad/CVE-2021-3129.git
    cd CVE-2021-3129
    ```

2. Install required Python packages:
    ```bash
    pip install requests
    ```

3. Run the script with the desired target and command:

    ```bash
    python3 CVE-2021-3129.py http://example.com --cmd 'id'
    ```

    Example output:
    
    ```bash
    [+] Generating PHAR payload for command: id
    [+] Trying to clear logs
    [+] Logs cleared
    [+] Convert log file to PHAR
    [+] Successfully converted logs to PHAR
    [+] PHAR deserialized
    ---------------------------------------
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    ---------------------------------------
    [+] Trying to clear logs
    [+] Logs cleared
    ```

## Arguments

- `target` (required): The URL of the vulnerable Laravel application.
- `--cmd` (optional): The command to be executed on the target (default: `whoami`).
- `--log_path` (optional): The log file path to be used (default: `../storage/logs/laravel.log`).

## POC

![POC](POC/1.png)

![POC](POC/2.png)

File Snapshot


 [4.0K]  /data/pocs/a9736c8098a7e0f8a5af044f2e6b6e210c7430e8
├── [4.0K]  CVE-2021-3129.py
├── [ 393]  Dockerfile
├── [4.0K]  gadgetchains
│   └── [4.0K]  Monolog
│       ├── [4.0K]  FW
│       │   └── [4.0K]  1
│       │       ├── [ 669]  chain.php
│       │       └── [1.1K]  gadgets.php
│       └── [4.0K]  RCE
│           ├── [4.0K]  1
│           │   ├── [ 610]  chain.php
│           │   └── [ 786]  gadgets.php
│           ├── [4.0K]  2
│           │   ├── [ 593]  chain.php
│           │   └── [ 864]  gadgets.php
│           ├── [4.0K]  3
│           │   ├── [ 532]  chain.php
│           │   └── [ 937]  gadgets.php
│           ├── [4.0K]  4
│           │   ├── [ 899]  chain.php
│           │   └── [1.8K]  gadgets.php
│           ├── [4.0K]  5
│           │   ├── [ 517]  chain.php
│           │   └── [ 744]  gadgets.php
│           ├── [4.0K]  6
│           │   ├── [ 520]  chain.php
│           │   └── [1.1K]  gadgets.php
│           ├── [4.0K]  7
│           │   ├── [ 721]  chain.php
│           │   └── [ 396]  gadgets.php
│           ├── [4.0K]  8
│           │   ├── [ 624]  chain.php
│           │   └── [1.1K]  gadgets.php
│           └── [4.0K]  9
│               ├── [ 607]  chain.php
│               └── [ 787]  gadgets.php
├── [4.0K]  lib
│   ├── [1.5K]  diagnose_payload.php
│   ├── [4.0K]  PHPGGC
│   │   ├── [4.0K]  Enhancement
│   │   │   ├── [2.2K]  ASCIIStrings.php
│   │   │   ├── [ 290]  Enhancement.php
│   │   │   ├── [ 541]  Enhancements.php
│   │   │   ├── [2.3K]  FastDestruct.php
│   │   │   ├── [ 802]  PlusNumbers.php
│   │   │   └── [1.4K]  Wrapper.php
│   │   ├── [  69]  Exception.php
│   │   ├── [4.0K]  GadgetChain
│   │   │   ├── [ 670]  FileDelete.php
│   │   │   ├── [ 703]  FileInclude.php
│   │   │   ├── [ 727]  FileRead.php
│   │   │   ├── [1.4K]  FileWrite.php
│   │   │   ├── [ 593]  PHPInfo.php
│   │   │   ├── [4.0K]  RCE
│   │   │   │   ├── [ 472]  Command.php
│   │   │   │   ├── [ 571]  FunctionCall.php
│   │   │   │   └── [ 587]  PHPCode.php
│   │   │   ├── [1.1K]  RCE.php
│   │   │   ├── [ 459]  SqlInjection.php
│   │   │   └── [ 458]  SSRF.php
│   │   ├── [5.8K]  GadgetChain.php
│   │   ├── [  80]  InvalidArgumentsException.php
│   │   ├── [4.0K]  Phar
│   │   │   ├── [2.9K]  Format.php
│   │   │   ├── [ 325]  Phar.php
│   │   │   ├── [4.1K]  Tar.php
│   │   │   └── [ 155]  Zip.php
│   │   └── [1.7K]  Util.php
│   ├── [ 27K]  PHPGGC.php
│   └── [1.1K]  test_payload.php
├── [ 247]  phpggc
├── [4.0K]  POC
│   ├── [ 25K]  1.png
│   └── [ 61K]  2.png
├── [1.8K]  README.md
└── [4.0K]  templates
    ├── [ 246]  chain.php
    └── [   7]  gadgets.php

22 directories, 56 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!