CVE-2025-31161 PoC — CrushFTP 安全漏洞

Source

Associated Vulnerability

Readme

# CVE-2025-31161 - CrushFTP Authentication Bypass Exploit

This Python script exploits CVE-2025-31161, an authentication bypass vulnerability in CrushFTP, allowing unauthenticated attackers to retrieve the user list from the getUserList API endpoint.

## Features

-    Authentication bypass via CrushAuth and AWS4-HMAC-SHA256 headers

-    Retrieve and display usernames (-l option)

-    Save full XML output to a file (-o option)

-    Optional proxy support


## Usage
```bash
python3 cve_2025_31161_auth_bypass.py -u "https://target:8080/"
```
### Options:

| Argument         | Description                                                           |
| ---------------- | --------------------------------------------------------------------- |
| `-u`, `--url`    | Target CrushFTP URL (required)                                        |
| `--proxy`        | Optional proxy (e.g., [http://127.0.0.1:8080](http://127.0.0.1:8080)) |
| `-l`, `--list`   | Display usernames only (clean output)                                 |
| `-o`, `--output` | Save the XML response to a file                                       |

# Example
```bash
python3 cve_2025_31161_auth_bypass.py -u "http://target:8443" --proxy http://127.0.0.1:8080 -o output.xml
```

<img width="1901" height="576" alt="exploit" src="https://github.com/user-attachments/assets/c9be6908-cf99-45ca-a4ba-c3a475ede854" />



Request/Response


<img width="1920" height="841" alt="burpsuite" src="https://github.com/user-attachments/assets/dbc906ef-fea5-4849-b777-6a18e696092e" />



# ⚠️ Disclaimer

This exploit is for educational and authorized testing only.
Unauthorized use is illegal.

---

## Official Channels

- [YouTube @rootctf](https://www.youtube.com/@rootctf)
- [X @r0otk3r](https://x.com/r0otk3r)

File Snapshot

 [4.0K]  /data/pocs/885db5bedd62413d75bd86af6f96641c710e8205
├── [3.3K]  cve_2025_31161_auth_bypass.py
└── [1.7K]  README.md

0 directories, 2 files

Remarks