This script is designed to exploit the Remote Code Execution (RCE) vulnerability identified in several Laravel versions, known as CVE-2021-3129. By leveraging this vulnerability, the script allows users to write and execute commands on a target website running a vulnerable Laravel instance, provided that the "APP_DEBUG" configuration is set to "true" in the ".env" file.
- 📜 Description
- 🛠️ Installation
- ⚙️ Usage
- 🐋 Docker POC
- 💻 Example
- 🩹 Patch options
- 💡 Contributing to the project
- 🕵🏼 References
- 📢 Disclaimer
Note
To ensure a clean and isolated environment for the project dependencies, it's recommended to use Python's venv module.
$ git clone https://github.com/joshuavanderpoll/CVE-2021-3129.git
$ cd CVE-2021-3129
$ python3 -m venv .venv
$ source .venv/bin/activate
$ pip3 install -r requirements.txt$ git clone https://github.com/joshuavanderpoll/CVE-2021-3129.git
$ cd CVE-2021-3129
$ python -m venv .venv
$ .venv\Scripts\activate
$ pip3 install -r requirements.txt
$ docker build -t laravel_vulnerable .
$ docker run -p 8000:8000 laravel_vulnerable
env(Updates the .env file to set APP_DEBUG to false)index(Injects code into index.php which prevents access to "/_ignition/execute-solution")private(Same as the index option, but allows specific header to access "_ignition/execute-solution")
To contribute, first fork this repository, and clone it. Make your changes, whether you're fixing bugs, adding features, or improving translations. When done, commit your changes, push them, and submit a pull request for review to this repostiroy.
If you're reporting an issue, make sure to include your Python version (python --version), your PHP version (php --version), and any relevant command input, and output.
For translation contributions, take a look at the lang/ folder to add or update translations for different languages.
This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by the tool.
