CVE-2025-5548-POC

Vulnerability Description

CVE-2025-5548 is a stack buffer overflow vulnerability identified in FreeFloat FTP Server, a legacy FTP service for Windows systems. The flaw resides in the NOOP command handler, which does not validate input size before copying it into a fixed-size buffer on the stack. This allows a remote, unauthenticated attacker to send an oversized string that overwrites the EIP register and redirects execution flow to arbitrary code.

• Type: Stack Buffer Overflow (CWE-121)
• Vector: Network (remote unauthenticated access)
• Impact: Remote Code Execution (RCE)
• Affected service: FreeFloat FTP Server — TCP/21, NOOP command
• Affected systems: Windows XP, Windows 7, Windows 10/11 (variations depending on active protections)

General Description

This repository documents a technical lab exercise on the CVE-2025-5548 vulnerability in a controlled environment. The main objective was to analyze the complete evaluation cycle: identify the vulnerable component, observe the service response to invalid inputs, and support with evidence the potential impact on system stability and security.

The practice was conducted with an academic and defensive cybersecurity approach. Priority was given to traceability of findings, quality of technical documentation, and definition of mitigation measures aimed at reducing the attack surface.

Contents

• Pasos.md: methodological development of the exercise, organized by phases with validation evidence.
• Conclusion.md: technical closure with results, applied methodology, and importance of the defensive approach.

Tools Used

• IDA Free: used for static analysis of the binary and location of relevant execution paths.
• Immunity Debugger: used for dynamic debugging and observation of registers and memory during controlled crashes.
• Mona.py: used to calculate offsets, validate bad characters, and assist in searching for jump instructions.
• Python 3: used to automate test cases and send inputs in a repeatable manner.
• Socket (Python standard library): used to establish TCP connections and transmit controlled test payloads.
• Metasploit tools: used for pattern generation and technical validation tests in the lab.
• Netcat (nc): used for connectivity checks and reception in controlled scenarios.
• Windows + Kali Linux environment: used to separate the target system from the analysis and support environment.

Scope and Responsible Use

The content of this repository is intended for training, research, and strengthening security controls in authorized environments. It should not be applied outside laboratories or on third-party systems without explicit permission from the owner.

Visual Evidence