In HTB Soulmate, we chain together two devastating 2025 CVEs, turning what looks like a standard web server into a lesson on why enterprise file transfer solutions are often the softest underbelly of a network.
We begin with the initial reconnaissance of CrushFTP, a service that often flies under the radar. This isn't just a generic FTP server but a complex web application with a critical flaw: CVE-2025-31161.
The thought process here is fascinating rather than brute-forcing credentials, we exploit a race condition and a mangled AWS4-HMAC header to bypass authentication entirely.
Things roll over when the server accepts a request with a simple username and a slash, granting full Admin privileges without a single password.
From there, we use this administrative access to upload a webshell (likely via the VFS configuration), securing the initial foothold.
Privilege escalation in HTB Soulmate involves Erlang. We discover an unusual service running (Erlang SSH) and connecting the dots to CVE-2025-32433, a vulnerability with a terrifying CVSS score of 10.0. It’s a pre-authentication RCE. You should send a specific SSH channel open request before the authentication handshake completes, effectively tricking the server into executing commands as the service owner (Root) without ever needing valid credentials.
Read the full thought process and exploit chain here:
0 comments