Lab scripts

This folder gathers the reproducible artifacts associated with the CVE-2025-5548 / FreeFloat FTP Server 1.0 lab. The teaching sequence and naming follow the reference teaching material from TheMalwareGuardian, while these versions have been rebuilt for this repository from the development and evidence of the exercise. They are not presented as byte-for-byte copies of the teaching files.

All scripts are intentionally restricted to 127.0.0.1. The goal is for them to accompany exclusively the local lab documented in docs/02-explotacion/.

Script	Role within the lab	Documentation
01Python3Connection.py	Connection validation and FTP interaction	Step 1
02Python3Fuzzing.py	Incremental fuzzing of the NOOP command	Step 2
03Python3EIPOffsetDiscovery.py	Sending the cyclic pattern to determine the EIP offset	Step 2
04Python3ControlEIP.py	Verification of EIP control with the documented offset	Step 3
05Python3FindBadChars.py	Validation of the bad characters identified during the exercise	Step 4
06Python3JMPESP.py	Verification of the redirection to ESP using an INT3 marker	Step 5
07Python3Shellcode.py	Safe reproduction of the final payload structure	Steps 6–7

Correspondence with the documented execution

The values that appear in the scripts must be interpreted within the context of the lab:

• The FTP service is tested at 127.0.0.1:21, as it appears in the screenshots of the exercise.
• The offset used is 246, obtained during the discovery phase and confirmed by overwriting EIP.
• The bad characters validated in the exercise are \x00, \x0a, and \x0d.
• The address 0x75CD9B23 (\x23\x9b\xcd\x75 in little endian) corresponds to the documented debugging session. The module where it was located had ASLR, so the address must be obtained again in a new run.
• The original evidence from Steps 6–7 documents the validation of a reverse shell. The public version of 07Python3Shellcode.py does not embed that shellcode: it uses an INT3 marker to preserve the traceability of the final layout without turning the repository into an operational remote-access artifact.

Provenance and license

The reference teaching material provides the methodology and the sequence of the seven steps. This repository adds the development carried out, the screenshots, and the adaptations specific to the execution. The original content of this repository is distributed under GPL-3.0, in accordance with the LICENSE file; third-party components and materials retain their respective terms of use.