Monsta FTP downloadFile Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_multi/http/monsta_ftp_downloadfile_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-34299 in Monsta FTP < 2.11.3 by hosting a malicious FTP server, triggering the target's downloadFile action to download a PHP payload, and then executing it via HTTP request.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a standard exploit for CVE-2025-34299. It sets up a malicious FTP server to deliver a PHP payload to a vulnerable Monsta FTP instance via the downloadFile action. All behavior is consistent with the described exploit: FTP service emulation, payload generation, HTTP request triggering, and payload execution. No concealed executable behavior, credential exfiltration, persistence mechanisms, or unrelated payloads were observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareMonsta FTP
Attack typesRemote Code ExecutionArbitrary File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a fully functional exploit that actively delivers and executes a payload on the target system. It includes code to start a malicious FTP server, trigger the vulnerable downloadFile action, serve a PHP payload, and execute it via HTTP.

modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:232-249

Requirements

  • Target must be running a vulnerable version of Monsta FTP (< 2.11.3).modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:22
  • Attacker must be able to host an FTP server reachable by the target.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:238-239

Observed behavior

  • Starts a malicious FTP server that authenticates any client with generated credentials.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:128-143
  • Sends an HTTP POST request to the target's API to trigger the downloadFile action, instructing it to connect to the attacker's FTP server and download a PHP file.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:204-224
  • Serves a PHP payload (meterpreter or command shell) when the target requests the file via FTP RETR.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:118-126
  • Triggers execution of the uploaded PHP payload by sending an HTTP GET request to the payload's location on the target.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:245-246
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
FTP server emulation to deliver PHP payload via Monsta FTP downloadFile actionThe module starts an FTP server (line 128-143) that serves a PHP payload (line 123) when the target connects and issues a RETR command. This matches the CVE description of arbitrary file upload from a malicious FTP server.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:128-143modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:118-126
Payload Generation
PHP payload wrapped in <?php ... ?> tagsThe module generates a PHP payload using Metasploit's payload framework (line 92-95). For PHP targets, it uses the selected payload directly; for command targets, it wraps the command in a PHP exec call. This is standard exploit behavior.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:92-95
Http Trigger
POST request to /application/api/api.php with JSON configurationThe module sends a crafted HTTP request to the target's API endpoint (line 208-224) to trigger the downloadFile action, causing the target to connect back to the attacker's FTP server and download the payload. This is the core exploit trigger.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:204-230
Cleanup Registration
register_file_for_cleanup(payload_name)The module registers the uploaded payload file for cleanup (line 244), which is a standard Metasploit practice to remove artifacts after exploitation. This is not malicious behavior.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:244
Review boundaries

What the analysis did not establish

  • Analysis is based on module source and metadata only; framework mixins, libraries, and external payloads are not expanded.
  • The artifact is not executed; classification is based on static analysis of the provided code.
  • Review is limited to the module source code. Framework mixins (e.g., Msf::Exploit::Remote::FtpServer, Msf::Exploit::Remote::HttpClient) and external payloads are not expanded or inspected.
  • Binary files were not present in the evidence; the binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, but no binary files were included.
  • The review does not assess the safety or correctness of the exploit against the target application.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1