Overview
In HackTheBox’s Soulmate machine, I exploited an unpatched CrushFTP instance on HackTheBox Soulmate machine to gain an initial foothold on the FTP web server. Followed by a PHP webshell for post-exploitation. Through the use of linPEAS, I ran automated enumeration to gain information on the user which revealed cleartext credentials to gain user access. Upon gaining access, I discovered a misconfigured Erlang service which reused those credentials and abused the erlang console by root command execution.
Conducting initial recon through nmap to discover any open ports:
To confirm my VPN is connected correctly, and confirm the machine is reachable, I pinged the target machine IP address.
nmap -sV -p 1-65535 -T4 -A -v -Pn 10.10.11.86Findings
- Port 80 (HTTP)
- Port 22 (SSH)
Troubleshooting
Port 80 appears to be running nginx 1.18.0. Initially I tried just visiting
http://10.10.11.86, which kept returning server not found errors. After doing some research, I found out I add to add the ip to the /etc/hosts file for it to correctly resolve to http://soulmate.htb For future notice, when the nmap scan returns something along the lines of “Did not follow redirect to <hostname>, you need to add the ip and hostname to the hosts file.After adding the ip/hostname to the hosts file, we can view the web server running a dating website.
Directory Enumeration
Since port 10.10.11.86:80 is open and resolves to http://soulmate.htb, I ran a gobuster script against a wordlist to discover any subdomains/directories.
GoBuster found a hit on
ftp.soulmate.htb/WebInterface/login.htmlVisting the URL, it appears to be a login screen for Soulmate’s FTP server, CrushFTP.
Examining the network traffic, I believe I was able to identify the version of CrushFTP
11.W.657.
Conducting vulnerability research on this version of CrushFTP led me to exploit-db, giving further details into CVE-2025-31161.
Vulnerability
CrushFTP before 10.8.4 and 11.3.1 allows unauthenticated HTTP(S) port access and full admin takeover through a race condition and header parsing logic flaw in the AWS4-HMAC authorization mechanism.
Exploiting this allows bypassing authentication and logging in as any known user (e.g. crushadmin)