CVE-2021-3129 PoC — Facade Ignition for Laravel 授权问题漏洞

Source

https://github.com/0x0d3ad/CVE-2021-3129

Associated Vulnerability

Title:Facade Ignition for Laravel 授权问题漏洞 (CVE-2021-3129)
Description:Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Description

CVE-2021-3129 Laravel Ignition RCE Exploit

Readme

# CVE-2021-3129 Laravel Ignition RCE Exploit

This is a Python exploit script for CVE-2021-3129, a remote code execution vulnerability in Laravel when the Ignition package is installed. This vulnerability allows an attacker to execute arbitrary system commands via PHAR deserialization.

## Features
- Automatically generates the PHAR payload using `phpggc`
- Accepts user input for any command to execute (e.g., `id`, `whoami`, etc.)
- Automates the entire exploitation process, including clearing logs, injecting the payload, converting logs to PHAR, and triggering the deserialization

## Prerequisites
- Python 3.x
- `requests` library
- PHP installed on your system
- [phpggc](https://github.com/ambionics/phpggc) installed (for generating PHAR payloads)

## Installation

1. Clone the repository:
    ```bash
    git clone https://github.com/0x0d3ad/CVE-2021-3129.git
    cd CVE-2021-3129
    ```

2. Install required Python packages:
    ```bash
    pip install requests
    ```

3. Run the script with the desired target and command:

    ```bash
    python3 CVE-2021-3129.py http://example.com --cmd 'id'
    ```

    Example output:
    
    ```bash
    [+] Generating PHAR payload for command: id
    [+] Trying to clear logs
    [+] Logs cleared
    [+] Convert log file to PHAR
    [+] Successfully converted logs to PHAR
    [+] PHAR deserialized
    ---------------------------------------
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    ---------------------------------------
    [+] Trying to clear logs
    [+] Logs cleared
    ```

## Arguments

- `target` (required): The URL of the vulnerable Laravel application.
- `--cmd` (optional): The command to be executed on the target (default: `whoami`).
- `--log_path` (optional): The log file path to be used (default: `../storage/logs/laravel.log`).

## POC

![POC](POC/1.png)

![POC](POC/2.png)

File Snapshot


 [4.0K]  /data/pocs/a9736c8098a7e0f8a5af044f2e6b6e210c7430e8
├── [4.0K]  CVE-2021-3129.py
├── [ 393]  Dockerfile
├── [4.0K]  gadgetchains
│   └── [4.0K]  Monolog
│       ├── [4.0K]  FW
│       │   └── [4.0K]  1
│       │       ├── [ 669]  chain.php
│       │       └── [1.1K]  gadgets.php
│       └── [4.0K]  RCE
│           ├── [4.0K]  1
│           │   ├── [ 610]  chain.php
│           │   └── [ 786]  gadgets.php
│           ├── [4.0K]  2
│           │   ├── [ 593]  chain.php
│           │   └── [ 864]  gadgets.php
│           ├── [4.0K]  3
│           │   ├── [ 532]  chain.php
│           │   └── [ 937]  gadgets.php
│           ├── [4.0K]  4
│           │   ├── [ 899]  chain.php
│           │   └── [1.8K]  gadgets.php
│           ├── [4.0K]  5
│           │   ├── [ 517]  chain.php
│           │   └── [ 744]  gadgets.php
│           ├── [4.0K]  6
│           │   ├── [ 520]  chain.php
│           │   └── [1.1K]  gadgets.php
│           ├── [4.0K]  7
│           │   ├── [ 721]  chain.php
│           │   └── [ 396]  gadgets.php
│           ├── [4.0K]  8
│           │   ├── [ 624]  chain.php
│           │   └── [1.1K]  gadgets.php
│           └── [4.0K]  9
│               ├── [ 607]  chain.php
│               └── [ 787]  gadgets.php
├── [4.0K]  lib
│   ├── [1.5K]  diagnose_payload.php
│   ├── [4.0K]  PHPGGC
│   │   ├── [4.0K]  Enhancement
│   │   │   ├── [2.2K]  ASCIIStrings.php
│   │   │   ├── [ 290]  Enhancement.php
│   │   │   ├── [ 541]  Enhancements.php
│   │   │   ├── [2.3K]  FastDestruct.php
│   │   │   ├── [ 802]  PlusNumbers.php
│   │   │   └── [1.4K]  Wrapper.php
│   │   ├── [  69]  Exception.php
│   │   ├── [4.0K]  GadgetChain
│   │   │   ├── [ 670]  FileDelete.php
│   │   │   ├── [ 703]  FileInclude.php
│   │   │   ├── [ 727]  FileRead.php
│   │   │   ├── [1.4K]  FileWrite.php
│   │   │   ├── [ 593]  PHPInfo.php
│   │   │   ├── [4.0K]  RCE
│   │   │   │   ├── [ 472]  Command.php
│   │   │   │   ├── [ 571]  FunctionCall.php
│   │   │   │   └── [ 587]  PHPCode.php
│   │   │   ├── [1.1K]  RCE.php
│   │   │   ├── [ 459]  SqlInjection.php
│   │   │   └── [ 458]  SSRF.php
│   │   ├── [5.8K]  GadgetChain.php
│   │   ├── [  80]  InvalidArgumentsException.php
│   │   ├── [4.0K]  Phar
│   │   │   ├── [2.9K]  Format.php
│   │   │   ├── [ 325]  Phar.php
│   │   │   ├── [4.1K]  Tar.php
│   │   │   └── [ 155]  Zip.php
│   │   └── [1.7K]  Util.php
│   ├── [ 27K]  PHPGGC.php
│   └── [1.1K]  test_payload.php
├── [ 247]  phpggc
├── [4.0K]  POC
│   ├── [ 25K]  1.png
│   └── [ 61K]  2.png
├── [1.8K]  README.md
└── [4.0K]  templates
    ├── [ 246]  chain.php
    └── [   7]  gadgets.php

22 directories, 56 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!