r0otk3r/cve-2025-31161Python exploit for CVE-2025-31161, an authentication bypass in CrushFTP. Retrieves user lists via crafted CrushAuth and AWS4-HMAC-SHA256 headers. Supports proxy and XML output.
This Python script exploits CVE-2025-31161, an authentication bypass vulnerability in CrushFTP, allowing unauthenticated attackers to retrieve the user list from the getUserList API endpoint.
Authentication bypass via CrushAuth and AWS4-HMAC-SHA256 headers
Retrieve and display usernames (-l option)
Save full XML output to a file (-o option)
Optional proxy support
python3 cve_2025_31161_auth_bypass.py -u "https://target:8080/"
| Argument | Description |
|---|
-u, --url | Target CrushFTP URL (required) |
--proxy | Optional proxy (e.g., http://127.0.0.1:8080) |
-l, --list | Display usernames only (clean output) |
-o, --output | Save the XML response to a file |
python3 cve_2025_31161_auth_bypass.py -u "http://target:8443" --proxy http://127.0.0.1:8080 -o output.xml
Request/Response
This exploit is for educational and authorized testing only. Unauthorized use is illegal.