lorenzoporrasduque/cve-2025-5548-pocEducational lab demonstrating a stack buffer overflow (CVE-2025-5548) in FreeFloat FTP Server. Covers full exploit development: vulnerability analysis, debugging with Immunity Debugger, offset calculation, and RCE payload generation.
CVE-2025-5548 is a stack buffer overflow vulnerability identified in FreeFloat FTP Server, a legacy FTP service for Windows systems. The flaw resides in the NOOP command handler, which does not validate input size before copying it into a fixed-size buffer on the stack. This allows a remote, unauthenticated attacker to send an oversized string that overwrites the EIP register and redirects execution flow to arbitrary code.
NOOP commandThis repository documents a technical lab exercise on the CVE-2025-5548 vulnerability in a controlled environment. The main objective was to analyze the complete evaluation cycle: identify the vulnerable component, observe the service response to invalid inputs, and support with evidence the potential impact on system stability and security.
The practice was conducted with an academic and defensive cybersecurity approach. Priority was given to traceability of findings, quality of technical documentation, and definition of mitigation measures aimed at reducing the attack surface.
The content of this repository is intended for training, research, and strengthening security controls in authorized environments. It should not be applied outside laboratories or on third-party systems without explicit permission from the owner.
