alberto-galindo/cve-2025-5548Security research and reproduction of CVE-2025-5548: A stack-based buffer overflow in FreeFloat FTP Server 1.0. Includes binary analysis, crash replication, and environment setup for vulnerability research.
Professional research and exploit development for a classic stack-based buffer overflow in FreeFloat FTP Server 1.0. This laboratory demonstrates the transition from binary reversing to a fully functional RCE.
This repository documents the analysis and exploitation of CVE-2025-5548. While modern systems have advanced protections, analyzing legacy software like FreeFloat FTP remains a foundational pillar for vulnerability researchers.
The research follows the principles discussed in the talk "The Path That Leads to Your First CVE", emphasizing that reverse engineering old desktop applications is the most realistic entry point for beginners in the field.
[Fuzzing] ──► [EIP Control] ──► [Bad Char Analysis] ──► [JMP ESP Gadget] ──► [RCE]
NOOP command to trigger a memory corruption.\x00\x0a\x0d) that break the payload.JMP ESP gadget to redirect execution to a custom Metasploit shellcode.| Component | OS / Version | Role |
|---|---|---|
| Target Server | Windows 10/11 (VM) | FreeFloat FTP Server 1.0 |
| Attacker Machine | Kali Linux / Windows | Exploit Delivery (Python 3) |
| Debugger | Immunity Debugger | Dynamic Analysis & Mona.py |
| Disassembler | IDA Pro 8.4 | Static Analysis & Reversing |
Note: All tests were conducted in an isolated host-only network segment.
| Category | Tools |
|---|---|
| Reversing | IDA Pro, Immunity Debugger |
| Exploitation | Python 3 (Socket), Mona.py, Metasploit (msfvenom) |
| Methodology | Stack-based Buffer Overflow |
| Reference | TheMalwareGuardian - CVE-2025-5548 |
| Directory | Content | Status |
|---|---|---|
| 01-Environment | Setup instructions for the lab and debugger. | ✅ Ready |
| 02-Exploitation | Core Methodology: Step-by-step exploit development. | ✅ Ready |
| Exploits | Full suite of Python scripts (from Fuzzing to Shellcode). | ✅ Ready |
| 03-Images | Documentation of crashes, offsets, and gadgets. | ✅ Ready |
The vulnerability exists because the server processes commands using unsafe C functions (like strcpy) without proper length validation.
// Simplified representation of the vulnerable handler
char buffer[256];
strcpy(buffer, user_input); // No bounds checking
When a long string is sent via the NOOP command, it overflows the local stack buffer, eventually overwriting the saved return address. By controlling this address, we can redirect the CPU to execute our own instructions.
Special thanks to TheMalwareGuardian for his research on legacy vulnerabilities and his educational approach to vulnerability research.