Use exploit.py and decrypt.java to obtain and decrypt the password. The key is hardcoded, so you can decrypt it and read arbitrary files.
Note that if the default admin, crushadmin, does not exist, you can try grabbing CrushFTP.log for account information.
<INCLUDE>CrushFTP.log</INCLUDE>
exploit.py
usage: exploit.py [-h] -u URL [-H HEADERS] [--account ACCOUNT] [--shell] [--jar-path JAR_PATH]
CVE-2024-4040
options:
-h, --help show this help message and exit
-u URL, --url URL The target URL
-H HEADERS, --headers HEADERS
Headers
--account ACCOUNT The target account
--shell
--jar-path JAR_PATH Jar file path
The logic first checks if the target is vulnerable using four default accounts and attempts to retrieve the user.XML file.
If the target is confirmed to be vulnerable, it retrieves the user-specified account; if not provided, it defaults to the crushadmin admin account.
After obtaining the password, it uses decrypt.java to decrypt the password.
--shell feature is used to conveniently view the results after Remote Code Execution (RCE). After uploading the JAR file using the following method, specify --jar-path and --headers to see the execution command's result:
Note that --headers must include the logged-in Cookie, for example, --headers "Cookie: currentAuth=a1FE; CrushAuth=1720166068377_Pa6SmqX7UzqLJ7gZtcllYhjlssa1FE"
--jar-path defaults to /tmp/mysql_cmd_db_user_final_with_echo_base64.jar. If it's in a different location, ensure to specify the path. Relative paths theoretically work but absolute paths are recommended.
After finding User Manager, click on the user on the left, drag the folder you want to map to User's Stuff, and finally adjust permissions. Ensure that upload is checked.
Upload Malicious JAR File
Upload the malicious JAR file. I have prepared two versions, one for JDK 16 and another for JDK 13, depending on the server's Java version.
Go back to the files section, click upload, and upload the malicious JAR file.
RCE
The reason for RCE is that there is a testDB function where you can specify the JAR file and driver object, and you can upload, combining these to achieve RCE.
