CrushFTP Authentication Bypass Exploitation

CVE-2025-31161 is a critical authentication bypass vulnerability in CrushFTP that allows unauthenticated remote attackers to gain unauthorized access to the application. Once the authentication mechanism is bypassed, attackers perform post-exploitation activities by executing system-level commands through the application's interface. Observed malicious activity includes the invocation of binaries like 'mesch.exe' or specific command arguments such as 'b64exec', 'fullinstall', or 'run'. This vulnerability has been actively exploited in the wild and linked to the Hellcat ransomware campaign. Defenders should monitor CrushFTP server logs for evidence of these specific command patterns, as they signify successful unauthorized access and subsequent execution of attacker-controlled code on the underlying host.

Attack Chain

1. Attacker sends a specially crafted HTTP request to the CrushFTP server to bypass authentication (CVE-2025-31161).
2. The application processes the request, allowing the attacker to reach restricted administrative or system-level endpoints.
3. Attacker uses the established session to execute arbitrary commands through the CrushFTP command interface.
4. Command execution triggers the launch of 'mesch.exe' or executes arguments like 'b64exec' or 'fullinstall'.
5. The server process spawns the requested commands, which may include further script execution or malware deployment.
6. Attacker gains persistence or performs reconnaissance on the system.
7. Attacker proceeds to stage and execute the final payload, such as Hellcat ransomware, for exfiltration and extortion.

Impact

Successful exploitation allows remote attackers to bypass authentication and execute code with the privileges of the CrushFTP service. This can lead to total system compromise, data theft, and the deployment of ransomware. The vulnerability has been explicitly linked to Hellcat ransomware campaigns, which target organizations using CrushFTP for file transfer services.

Recommendation

1. Patch CrushFTP immediately by upgrading to the version that remediates CVE-2025-31161.
2. Enable ingestion of CrushFTP logs into your SIEM and deploy the detection rules below to identify exploitation attempts.
3. Review all CrushFTP server activity for the command patterns 'mesch.exe', 'b64exec', 'fullinstall', or 'run' in process or execution logs.
4. Isolate internet-facing CrushFTP servers or apply strict access controls to limit exposure to these services.
5. Investigate any instances where unauthorized users or suspicious IPs are observed executing system commands via the CrushFTP interface.