CVE-2025-31161 — Python exploit script for CVE-2025-31161 targeting CrushFTP. Enumerates users and creates malicious accounts with elevated permissions via HTTP requests. | Kitploit

Description

This repository contains a Python script to interact with the CrushFTP service vulnerable to CVE-2025-31161 The script allows you to list existing users and add a malicious user by exploiting the vulnerability.

Features

Check if the host is up before executing commands.
List valid users on the CrushFTP server.
Create a malicious user with elevated permissions.
Basic HTTP response and error handling.

Requirements

Python 3.10 or higher
requests module

Install dependencies:

pip install -r requirements.txt

CVE-2025-31161

Most Popular

List users

Add Malicious User

Examples:

List users on a target:

Add a malicious user: