---
description: A small explanation of an Apache path traversal bug and an incomplete fix
---

# Apache HTTP Server Path Traversal: CVE-2021-41773/42013

{% embed url="https://tryhackme.com/room/cve202141773" %}
[https://tryhackme.com/room/cve202141773](https://tryhackme.com/room/cve202141773)
{% endembed %}

| Room Attributes       | Value                                                                   |
| --------------------- | ----------------------------------------------------------------------- |
| Subscription Required |  <mark style="color:green;background-color:green;">False</mark> \[Free] |
| Type                  | Walkthrough                                                             |
| Difficulty            |  <mark style="color:blue;background-color:blue;">Info</mark>            |
| Tags                  | Security, Apache, CVE-2021-41773, CVE-2021-42013                        |

## Task 1 - A Bit of Background...

### What version of Apache httpd was initially vulnerable to this CVE?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`2.4.49`

</details>

### This vulnerability requires an unusual misconfiguration for it to be exploitable (Yea/Nay)

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`Yea`

</details>

## Task 2 - What is Path Traversal anyways?

### A path traversal exploit will (choose the best answer):

* A) Include arbitrary remote files to be processed on the server.
* B) Include arbitrary local files to be processed on the server.
* C) Allow arbitrary files to be exposed by the server.
* D) None of the above.

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`C`

</details>

### URL-encode the . symbol

{% hint style="warning" %}
**HINT:** Uppercase hex is the preferred standard by the RFC (though lowercase is equivalent, this answer should be in uppercase)
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`%2E`

</details>

### What does this URL fragment decode to:  %%32%65 ?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`%2e`

</details>

## Task 3 - Ok, Ok; Gib Hax!

### What module needs to be enabled in order to get remote code execution?

{% hint style="warning" %}
**HINT:** There are technically two different modules depending on if another module is enabled. This answer uses the shorter of the two.
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`mod_cgi`

</details>

## Task 4 - Practical Exam

### What is the flag on port 8080?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{724V3R51N6_P4TH5_F02_FUN}`

</details>

### What is the flag on port 8081?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{2C3_F20M_C61}`

</details>

### What is the flag on port 8082?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{D0UBL3_3NC0D1N6_F7W}`

</details>

### What is the flag on port 8083?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{F1L732_8YP455_2C3}`

</details>

### I was able to pop a shell! (I can't actually verify this, so I'll trust you on that one :))

{% hint style="warning" %}
**HINT:** If you need some help with the shell, visit [https://www.revshells.com/](https://www.revshells.com/)
{% endhint %}

{% hint style="success" %}
No answer needed
{% endhint %}

### What user is the Apache server running as?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`daemon`

</details>

### Find the root flag on the machine on port 8083?

{% hint style="warning" %}
**HINT:** The root password is: ApacheCVE
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{P21V_35C_F20M_4P4CH3_15_FUN}`

</details>

