CVE-2025-5548 — Buffer Overflow in FreeFloat FTP Server 1.0

Vulnerability analysis and exploitation lab · Exploit Development · Windows x86

What is this repository about?

This repository fully documents the analysis and exploitation process of the CVE-2025-5548 vulnerability, a stack-based buffer overflow present in FreeFloat FTP Server 1.0 for Windows.

The goal is not only to exploit the vulnerability, but to explain how to build an analysis lab from scratch: what tools are needed, why they are needed, and how each one is used throughout the exploitation process. The entire environment is set up manually and step by step, without automated scripts, allowing a deep understanding of each phase of the process.

About the vulnerability

CVE-2025-5548 is a buffer overflow in FreeFloat FTP Server.

The vulnerability occurs when the FTP server receives a specially crafted input via the NOOP command. By not validating the size of the received buffer, it is possible to overflow the stack, overwrite the EIP register, and redirect the execution flow to arbitrary code controlled by the attacker.

Repository structure

CVE-2025-5548-FreeFloat-FTP-Buffer-Overflow/
│
├── docs/
│   ├── 01_environment_setup.md     ← Part 1: Environment setup
│   └── 02_exploitation.md          ← Part 2: Exploitation of the vulnerability
│
├── exploits/
│   ├── exploit01.py                ← Connectivity verification
│   ├── exploit02.py                ← Fuzzing the NOOP command
│   ├── exploit03.py                ← Sending the cyclic pattern
│   ├── exploit04.py                ← Verification of EIP control
│   ├── exploit05.py                ← Identification of bad characters
│   └── exploit06.py                ← Final exploit with JMP ESP
│
└── images/
    └── *.png                       ← Screenshots used in documentation

Contents

Part 1 — Environment setup

Manual installation and configuration of all necessary tools for the lab, with screenshots and an explanation of why each one is needed.

📄 View documentation → docs/01_environment_setup.md

Part 2 — Exploitation of the vulnerability

Complete exploitation process documented phase by phase, from the first crash to full control of the execution flow.

📄 View documentation → docs/02_exploitation.md

Exploitation flow

graph LR
A["Controlled input: NOP + buffer"] --> B["Buffer Overflow"]
B --> C["EIP overwriting"]
C --> D["EIP → JMP ESP address"]
D --> E["JMP ESP"]
E --> F["ESP → controlled buffer"]
F --> G["NOP sled"]
G --> H["Shellcode"]

Controlled input (NOOP + buffer)
           ↓
      Buffer Overflow
           ↓
   EIP overwriting
           ↓
  EIP → JMP ESP address
           ↓
         JMP ESP
           ↓
  ESP → controlled buffer
           ↓
         NOP sled
           ↓
         Shellcode

Relationship between tools and exploitation flow

• Immunity Debugger → crash analysis and EIP control
• Mona → offset calculation and address search
• Python → sending payloads to the server
• Ncat → manual interaction with the FTP service

This lab does not focus solely on running an exploit, but on understanding the complete process of vulnerability analysis and exploitation.

Disclaimer

This repository is for educational purposes only. All analysis and exploitation are performed on vulnerable software in a controlled and isolated environment. Do not use these techniques against systems without explicit authorization.