CrushFTP 10.8.0 — CVE-2025-31161 Vulnerable Build

Pre-built CrushFTP 10.8.0 binary for authorized penetration testing of CVE-2025-31161.

[!CAUTION] This is an intentionally vulnerable application build. For authorized security testing and research only. Do not deploy on production systems or expose to untrusted networks.

What's Included

The release asset CrushFTP10_10.8.0_4.zip contains the full CrushFTP 10.8.0 build 4 application extracted from the netlah/crushftp:10.8.0_4 Docker image.

Java is not included. The companion Ludus role (rufflabs/ludus_crushftp_cve-2025-31161) handles JDK provisioning automatically.

Provenance

Source:     Docker Hub netlah/crushftp:10.8.0_4
Image:      sha256:d6eca9c6a3a9d09debde37590ce91b3b1f8bb7587368639cc847487515e67d03
Build Date: 2024-06-27 01:52:22 UTC
Version:    CrushFTP 10.8.0 build 4
Java:       Temurin JDK 17.0.11+9 (build-time; not bundled)

CVE-2025-31161 Summary

Manual Lab Setup

If you're not using Ludus, you can set this up manually:

# Download the release asset
wget https://github.com/rufflabs/crushftp_cve-2025-31161/releases/download/v10.8.0_4/CrushFTP10_10.8.0_4.zip

# Extract
unzip CrushFTP10_10.8.0_4.zip -d /opt/crushftp
cd /opt/crushftp

# Create admin user
java -jar CrushFTP.jar -a crushadmin Password123

# Start
java -Xmx512m -jar CrushFTP.jar -d

Requires JDK 17+. Web interface listens on :8080 (HTTP) and :443 (HTTPS).

References

• ProjectDiscovery Technical Writeup
• Huntress In-the-Wild Analysis
• Exploit-DB PoC
• Immersive Labs PoC

License

The CrushFTP software is proprietary and owned by CrushFTP LLC. This repository hosts a specific build for security research purposes under fair use. No license is granted for production use of CrushFTP. Visit crushftp.com for commercial licensing.