Rejected duplicate of CrushFTP authentication bypass (use CVE-2025-31161)

Repository contains a single Python proof-of-concept exploit script (CVE-2025-31161.py) and a README. The script targets a CrushFTP web interface endpoint at /WebInterface/function/ over HTTP (default port 8080). It performs a preliminary GET 'warm-up' request, then sends a crafted POST request with parameters invoking the administrative command 'setUserItem' against serverGroup 'MainUsers'. The POST body includes an XML 'user' object that defines a new username/password, sets root_dir to '/', and assigns broad site/VFS permissions, effectively creating a new privileged account. The exploit relies on an auth-bypass pattern using hardcoded cookie/token values (currentAuth/c2f) and an Authorization header that references an existing username (default 'crushadmin'); the README notes the attacker must know a valid existing username. Success is determined by HTTP 200 and the presence of '<response_status>OK</response_status>' in the response.

This repository provides a comprehensive exploitation and detection toolkit for CVE-2025-2825 and CVE-2025-31161, critical authentication bypass vulnerabilities in CrushFTP versions 10.0.0–10.8.3 and 11.0.0–11.3.0. The main exploit (new_user.py) is a Python script that leverages a flaw in the S3-compatible API authentication logic, allowing an unauthenticated attacker to create a new administrative user by sending a crafted HTTP POST request to the /WebInterface/function/ endpoint with a forged AWS4-HMAC-SHA256 Authorization header. The script supports specifying the target host, port, username, and password for the new account. Additionally, the repository includes two Nuclei templates: - active.yaml: An active detection template that attempts to exploit the vulnerability by requesting the user list as an unauthenticated user, confirming the presence of the flaw. - passive.yaml: A passive detection template that fingerprints CrushFTP instances using favicon hashes, cookies, and page content. The README.md provides an in-depth technical analysis of the vulnerability, affected versions, exploitation methodology, and mitigation recommendations. The exploit is operational, providing a working payload for account creation and detection templates for both active and passive scanning. The attack vector is network-based, targeting publicly accessible CrushFTP web interfaces. The main fingerprintable endpoints are /WebInterface/function/, /WebInterface/login.html, and /favicon.ico.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-2825, a critical authentication bypass vulnerability in CrushFTP (versions prior to 10.6.0). The exploit leverages improper validation of the 'X-Forwarded-For' HTTP header: by setting this header to '127.0.0.1', the server treats the request as originating from localhost, thereby bypassing authentication checks. The repository contains two files: a detailed README.md explaining the vulnerability, affected versions, and mitigation steps, and a Python script (cve-2025-2825-poc.py) that automates the exploit. The script prompts the user for the target CrushFTP URL, sends a crafted GET request to the login validation endpoint with the spoofed header, and displays the server's response. The exploit is network-based and requires the attacker to know the target's address. No payload for post-exploitation is included; the script demonstrates the authentication bypass only. The repository is a clear, functional PoC for this vulnerability.

This repository contains a Python exploit script (Shattered.py) and a README. The script targets two authentication/user creation vulnerabilities in CrushFTP (CVE-2025-2825 and CVE-2025-31161). It allows the attacker to create a new user account on the target server by sending a crafted XML payload to the /WebInterface/function/ HTTP endpoint. The script supports both single-target and mass exploitation modes, with multi-threading for efficiency. It can log results to a CSV file. The exploit is operational, as it provides a working payload and automates the attack process. The README provides usage instructions and context for the vulnerabilities. No hardcoded IPs or domains are present; the script is designed to be used against user-specified targets. The main entry point is Shattered.py, which parses command-line arguments and orchestrates the attack.

This repository contains a single Metasploit auxiliary module targeting an authentication bypass vulnerability (CVE-2025-2825) in CrushFTP versions 11 < 11.3.1 and 10 < 10.8.4. The exploit leverages a flaw in the AWS4-HMAC authentication mechanism, allowing an attacker with knowledge of a valid username to forge a session cookie and authenticate as that user without valid credentials. The module interacts with the CrushFTP web interface (default port 8080), first confirming the service, then sending a crafted POST request to the '/WebInterface/function/' endpoint with a malicious Authorization header and session cookie. If successful, it outputs a valid session cookie (CrushAuth) for the target user, enabling further authenticated actions. The exploit is operational, providing a working session cookie, and is suitable for use in penetration testing or red teaming engagements. The only file present is a Ruby script designed for use within the Metasploit framework.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-2825, a severe authentication bypass vulnerability in CrushFTP. The repository contains two files: a README.md describing the vulnerability and its impact, and a 'payload' file containing a raw HTTP GET request. The payload demonstrates how an attacker can retrieve the user list from a vulnerable CrushFTP instance without valid credentials, exploiting the authentication bypass. The exploit targets the web interface of CrushFTP, specifically the '/WebInterface/function/' endpoint, and uses crafted cookies and headers to bypass authentication. The repository is structured as a simple PoC, with the main exploit logic contained in the 'payload' file. No exploit framework is used, and the exploit is operational as a network-based attack against accessible CrushFTP servers.

This repository contains a Bash proof-of-concept exploit for CVE-2025-2825, an authentication bypass vulnerability in CrushFTP versions 10.0.0–10.8.3 and 11.0.0–11.3.0. The exploit script (exploit_crushftp.sh) automates a double-request attack against the CrushFTP WebInterface, targeting the /WebInterface/function/ endpoint. It crafts a fake AWS S3-style Authorization header and a CrushAuth cookie whose last four characters match the 'c2f' parameter, exploiting the authentication logic flaw. The script first sends a 'warmup' request, then a second request to trigger the vulnerability and attempts to extract the user list from the server's response. The README provides usage instructions and explains the exploit's mechanism. No hardcoded IPs or domains are present; the target is supplied as a command-line argument. The repository is focused, containing only the exploit script and documentation.