HackTheBox - Soulmate

Why It Matters

Understanding multi‑layered reconnaissance and obscure CVE exploits like CVE‑2025‑31161 enables faster, more reliable penetration testing, turning hidden services into entry points for full system compromise.

Key Takeaways

• Perform parallel reconnaissance before chasing immediate code execution.
• Enumerate virtual hosts to uncover hidden FTP service on subdomain.
• Identify CVE‑2025‑31161 authentication bypass vulnerability in Crush FTP.
• Exploit the bypass to create a privileged user on the box.
• Leverage predictable upload filenames to gain remote code execution.

Summary

The video walks through the Hack The Box “Soulmate” challenge, emphasizing a disciplined, multitasked reconnaissance approach rather than a straight‑to‑code‑execution mindset. Ipsac begins with an Nmap sweep, discovers only SSH and HTTP, then adds a host entry for soulmate.htb and probes the web interface, quickly moving to virtual‑host fuzzing to reveal an overlooked FTP subdomain. Key insights include using tools like fuff for rapid vhost enumeration, running Nuclei scans in the background, and recognizing that the FTP service (Crush FTP) is vulnerable to CVE‑2025‑31161 – an authentication bypass that requires a valid username and a crafted cookie. The exploit script leverages this flaw to add a new user, effectively granting shell access without legitimate credentials. A notable example is the analysis of the profile‑picture upload mechanism, where the filename incorporates a timestamp and user ID, hinting at predictable paths for potential web‑shell placement. Ipsac also demonstrates manipulating the vulnerable endpoint by injecting the required cookie and observing inconsistent 502 responses, illustrating the quirks of the underlying bug. The walkthrough underscores that thorough, parallel reconnaissance can surface hidden services and obscure vulnerabilities, saving time and effort. For penetration testers, mastering such nuanced exploits and understanding application‑specific quirks—like predictable filenames and custom authentication logic—can be the difference between a stalled box and a full compromise.

Original Description

00:00 - Introduction

00:40 - Start of nmap

02:10 - Bruteforcing virtualhosts with ffuf

03:30 - Discovering CrushFTP, running nuclei which will get the version

04:50 - Playing with the soulmate.htb website while our recon runs

09:20 - Looking at CVE-2025-31161 which nuclei told us, its an exploit within CrushFTP then manually playing with the exploit

14:00 - Showing CrushFTP also leaks the version when requesting javascript files to load the page

17:00 - Finding a CVE that exploits this

21:00 - Showing we don't actually need to create a user with this exploit

27:30 - Changing the FTP Home Directory to the root webserver, which will let us upload a webshell

30:00 - Shell on the box, looking at the database

34:40 - Looking at running processes, discovering an erlang script

35:50 - Unintended: Exploiting the erlang application though the erl shell

40:00 - Exploiting CVE-2025-32433 which is a unauth poc against erlangs SSH Server