# CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation

CrushFTP S3 Authorization header logic bug lets unauthenticated attackers impersonate crushadmin, gaining admin access and enabling backdoor accounts and RMM malware deployment.

- Payout: Real-world hack
- Severity: critical
- Program: CrushFTP
- Credited: Huntress
- Disclosed: 2025-04-04
- CVE: CVE-2025-31161
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
- Tags: domain:web impact:ato impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:aws technique:chained technique:source-review vuln:access-control vuln:auth-bypass

**Target:** CrushFTP MFT web interface (/WebInterface/function/)
**Root cause:** Logic bugs in S3 authorization header processing cause the server to treat an AWS4-HMAC-SHA256 Authorization header with a valid username as authenticated, without validating credentials. A forged CrushAuth cookie plus matching c2f parameter satisfies the remaining session checks.
**Steps:**
1. Send `GET /WebInterface/function/?command=getUserList&serverGroup=MainUsers&c2f=1111 HTTP/1.1` with `Cookie: CrushAuth=1111111111_111111111111111111111111111111111` and `Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/`
2. CrushAuth must be a ~31-char alphanumeric string; c2f must equal its last 4 chars
3. If the forged CrushAuth is unknown to the instance, issue a second request so the server registers it
4. Use admin functions like `command=setUserItem` to create a backdoor admin account, or `command=openFile`/`closeFile` to upload payloads
**How found:** Huntress recreated a PoC from public Project Discovery/Rapid7/Outpost24 analysis of the S3 auth logic, then hunted CrushFTP.log for AWS4-HMAC-SHA256 Credential=crushadmin/ entries lacking a currentAuth cookie to identify in-the-wild exploitation.
**Exploitation:** Attacker sends the crafted Authorization header to bypass auth as crushadmin, then uses setUserItem to create a persistent admin account (e.g. Eaion6Mz) with a set password and backdated last_login, or uploads RMM agents (MeshAgent, AnyDesk, SimpleHelp) and a TgBot DLL via openFile/closeFile, then executes them to establish remote access, dump SAM/System hives, add local admin users, and install Cloudflare Tunnel for persistence.
**Escalation:** Auth bypass as crushadmin yields full admin control; attackers pivot to OS-level RCE via uploaded RMM binaries, credential dumping, Defender exclusion abuse, and tunnel-based persistence.
**Insight:** When a product implements S3-compatible auth, the Authorization header parser is a high-value target: check whether a syntactically valid but unsigned/credential-only header short-circuits the auth check, and whether a self-chosen session cookie plus a matching c2f suffix is enough to satisfy session validation.