# Apache 2.4.49 Configuration - INTENTIONALLY VULNERABLE
# CVE-2021-41773 / CVE-2021-42013 Test Environment
# DO NOT USE IN PRODUCTION

ServerRoot "/usr/local/apache2"
Listen 80

# Load required modules
LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule access_compat_module modules/mod_access_compat.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule reqtimeout_module modules/mod_reqtimeout.so
LoadModule filter_module modules/mod_filter.so
LoadModule mime_module modules/mod_mime.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule env_module modules/mod_env.so
LoadModule headers_module modules/mod_headers.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule version_module modules/mod_version.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so

# CRITICAL: Load CGI module - required for RCE exploitation
LoadModule cgi_module modules/mod_cgi.so
LoadModule cgid_module modules/mod_cgid.so

# Server identity - only accept gpigs.devergolabs.com
ServerAdmin admin@localhost
ServerName gpigs.devergolabs.com:80

# Document root with VULNERABLE configuration
# The "Require all granted" on root filesystem enables path traversal
DocumentRoot "/usr/local/apache2/htdocs"

# VULNERABLE: Allow access to filesystem root
# This is what makes path traversal exploitable
# Options +ExecCGI enables RCE via /bin/sh traversal
<Directory />
    AllowOverride None
    Options +ExecCGI +FollowSymLinks +Indexes
    Require all granted
</Directory>

# CRITICAL: Enable CGI execution for /bin directory (RCE target)
<Directory "/bin">
    Options +ExecCGI
    SetHandler cgi-script
    Require all granted
</Directory>

<Directory "/usr/bin">
    Options +ExecCGI
    SetHandler cgi-script
    Require all granted
</Directory>

<Directory "/usr/local/apache2/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

# Directory index
<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>

# Deny access to .htaccess files
<Files ".ht*">
    Require all denied
</Files>

# Logging
ErrorLog /proc/self/fd/2
LogLevel warn

<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    CustomLog /proc/self/fd/1 common
</IfModule>

# CGI Configuration - CRITICAL for RCE
# This enables command execution via path traversal
ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"

<Directory "/usr/local/apache2/cgi-bin">
    AllowOverride None
    Options +ExecCGI
    Require all granted
    # Allow .sh scripts to execute as CGI
    AddHandler cgi-script .cgi .sh
</Directory>

# MIME types
<IfModule mime_module>
    TypesConfig conf/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType text/html .shtml
    AddHandler cgi-script .cgi .sh
</IfModule>

# Server signature (reveals version - useful for reconnaissance)
ServerTokens Full
ServerSignature On