Step-by-step guide to exploit a buffer overflow in FreeFloat FTP Server using Python fuzzing, Immunity Debugger with mona.py, and IDA Free for binary analysis and payload development.
Target platform: Windows
This guide details all the tools required to perform vulnerability analysis and fuzzing of the binary. Follow the steps in order to ensure everything is set up correctly.
Download: python.org/downloads/windows
Python 3 is the language we will use to write fuzzing scripts. Its simplicity and rich ecosystem make it ideal for automating payload delivery to the target binary, handling network connections, and processing responses.
Installation: Download the .exe installer from the link and run it. During installation, make sure to check ✅ "Add Python to PATH" — otherwise, you won’t be able to invoke python from the terminal.
Download: github.com/kbandla/ImmunityDebugger
Immunity Debugger is a process-level debugger specifically geared toward security analysis and exploit research. It allows you to inspect registers, memory, the stack, and the heap in real time while the program is running — exactly what we need to identify and verify a buffer overflow.
⚠️ Note: Immunity Debugger has been discontinued and its official website is no longer available. However, it is still widely used in the security community and in academic environments due to its integration with the mona.py plugin, low resource usage, and intuitive interface for exploit analysis on 32-bit Windows systems. The referenced GitHub repository contains the installer binary as originally distributed.
Installation: Clone the repository. The executable is located in ImmunityDebugger\1.85\ImmunityDebugger.exe and does not require installation.
Download: python.org/download/releases/2.7
Immunity Debugger’s scripting engine is built on Python 2.7, making this version a strict requirement for the tool to function properly — particularly for running the mona plugin.
ℹ️ Python 2.7 and Python 3 can coexist on the same system without issues. Just make sure Python 3 remains the primary version in your PATH.
Installation: Download and run the installer. It is not necessary to add it to PATH if Python 3 is already configured.
Download: github.com/corelan/mona
mona.py is the flagship plugin for Immunity Debugger, developed by the Corelan Team. It automates the most tedious parts of exploit development:
pattern_create, pattern_offset)JMP ESPInstallation:
mona.py file into the Immunity commands directory:ImmunityDebugger\1.85\PyCommands\mona.py
Once copied, you can invoke it from the Immunity command bar with:
!mona help
Download: code.visualstudio.com
🟡 Optional — but highly recommended.
VS Code is the editor where we will write our Python fuzzing scripts. It provides syntax highlighting, intelligent autocompletion, an integrated terminal, and extension support that significantly improves workflow efficiency.
Recommended extension: Python — Microsoft
It provides IntelliSense, linting, integrated debugging, and Python interpreter selection directly within VS Code. Once installed, make sure to select the correct interpreter (Python 3) from the editor’s bottom bar.
Download: hex-rays.com → Downloads section → IDA Free
IDA (Interactive DisAssembler) is the industry standard for binary reverse engineering. The free version (IDA Free) is more than sufficient for this analysis: it allows you to disassemble the target executable, navigate its functions, identify dangerous calls such as strcpy or gets, and understand the program flow without access to the source code.
🔐 License: The individual, non-commercial version is completely free. It only requires registration with a valid email. The installer and license are downloaded from the Hex-Rays Customer Portal.
Installation:
Download the .exe installer from the Customer Portal and run it following the wizard steps.
After installation, the wizard will indicate that you must place the license file (.hexlic) in the following path:
%APPDATA%\Hex-Rays\IDA Pro\
.hexlic file from the Licenses section of the Customer Portal and copy it to that location. The next time you launch IDA, the license will be automatically activated. ✅The target binary is FreeFloat FTP Server v1.0, a lightweight FTP server for Windows. It is software with known and well-documented vulnerabilities in the security community, making it a classic target for practicing buffer overflow techniques in controlled environments.
📦 The executable is available in this same repository: FreeFloatFtpServer1.0.zip
Extract the zip file to obtain Win32/FTPServer.exe, which is the binary we will use throughout the entire analysis.
Continue in 02 Vulnerability →
Happy hacking! 🎯