Critical 9.8 Auth Bypass

Crush FTP is an enterprise-grade managed FTP server.

This year, they again hit a critical 9.8 auth bypass vulnerability.

In this video, we will analyze the vulnerability payload and create an exploit that will add an admin user to the server.

// Tags

#ethicalhacking #crushftp #CVE-2025-31161 #authbypass #exploitdev

// Chapters

0:00 - Intro
0:48 - Payload Analysis
1:51 - Reverse engineering Crush FTP
2:34 - Creating the exploit
3:39 - Triggering the vulnerability
5:14 - Creating the regular user
7:40 - Making the user admin
8:44 - Why CrushFTP are being targeted by attackers?

// Links

* NIST: https://nvd.nist.gov/vuln/detail/CVE-2025-31161
* Vulnerability Analysis: https://projectdiscovery.io/blog/crushftp-authentication-bypass

Видео Critical 9.8 Auth Bypass канала Hack the Clown