Ansible Role: CrushFTP CVE-2025-31161 Simulation (Ludus)

Companion role for ludus_crushftp_cve-2025-31161 that adds a realistic scenario layer on top of the vulnerable CrushFTP instance.

[!NOTE] This role requires the main ludus_crushftp_cve-2025-31161 role to be applied first.

What It Does

Simulated Business Process — Creates a CrushFTP user account (svc_fileprocessor) with sensitive data files that rotate every 2 minutes, giving the attacker something worth exfiltrating after exploiting the auth bypass.

Defender Simulation — A scheduled task runs every 5 minutes that removes any Windows services matching exfil*, simulating an EDR or defender cleanup. Pentesters must work around this to maintain persistence.

Data Files

The rotation script creates files named sensitive_data_<timestamp>.txt containing a CONFIDENTIAL header and the SHA256 hash of the filename. A maximum of 5 files are kept; the oldest is deleted when a new one is created.

Requirements

• The main ludus_crushftp_cve-2025-31161 role must be applied to the same VM first.
• CrushFTP must be installed and the service running before this role executes.

Role Variables

# CrushFTP install dir (must match main role)
ludus_crushftp_sim_install_dir: "C:\\CrushFTP"

# Simulated business user
ludus_crushftp_sim_user: "svc_fileprocessor"
ludus_crushftp_sim_password: "Pr0c3ss!ng2024"

# Data directory and rotation settings
ludus_crushftp_sim_data_dir: "C:\\CrushFTP\\svc_fileprocessor_home"
ludus_crushftp_sim_max_files: 5
ludus_crushftp_sim_data_interval_minutes: 2

# Service cleanup settings
ludus_crushftp_sim_cleanup_interval_minutes: 5
ludus_crushftp_sim_exfil_pattern: "exfil*"

Dependencies

Must run after ludus_crushftp_cve-2025-31161.

Example Ludus Range Config

ludus:
  - vm_name: "{{ range_id }}-crushftp"
    hostname: "{{ range_id }}-CRUSH"
    template: win2022-server-x64-template
    vlan: 20
    ip_last_octet: 10
    ram_gb: 4
    cpus: 2
    windows:
      sysprep: true
    roles:
      - ludus_crushftp_cve-2025-31161
      - ludus_crushftp_cve-2025-31161_sim
    role_vars:
      ludus_crushftp_admin_password: "CrushAdmin123!"
      ludus_crushftp_sim_password: "Pr0c3ss!ng2024"

Ludus Usage

ludus ansible role add -d ./ludus_crushftp_cve-2025-31161_sim
ludus range deploy -t user-defined-roles

Testing Scenario

After deployment, a pentester would:

1. Exploit CVE-2025-31161 to bypass authentication as crushadmin
2. Discover the svc_fileprocessor account and its data files
3. Exfiltrate sensitive_data_*.txt files via the CrushFTP interface
4. Attempt to install persistence (e.g., a service named exfil_c2) — which gets cleaned up every 5 minutes
5. Need to find a persistence method that survives the cleanup, or exfiltrate faster than the rotation window

License

MIT

Author Information

This role was created by rufflabs, for Ludus.