sudoand3rs0n/cve-2025-5548
Educational repository documenting the analysis and exploitation of CVE-2025-5548 (FreeFloat FTP Server buffer overflow). Includes a reusable vulnerability analysis methodology, static reverse engineering, step-by-step exploitation, and a 0-day approach guide with fuzzing and debugging techniques.
Anderson Steven — Master in Cybersecurity, Module 6 (Vulnerabilities) Individual assignment: Methodology for vulnerability analysis and exploitation
I did not want to simply hand in "here is the exploit working". This repository
reflects how I work when facing a memory corruption vulnerability: what I look at first,
in what order I discard hypotheses, what tools I use at each phase and why. I use
CVE-2025-5548 as a thread because it is a small, manageable case, but the central
document of this repo — METHODOLOGY.md — is not a tutorial on
"how to exploit FreeFloat FTP", it is my way of reasoning about any binary, adaptable
to other cases.
FreeFloat FTP Server 1.0 is a Windows FTP server from over a decade ago, unmaintained,
which is still used in exploitation labs because its flaw is textbook: when processing
certain protocol commands (NOOP is the one I work with here, although it is not the
only one) it copies what the client sends to a fixed stack buffer using strcpy,
without checking the input length. If you send more data than fits, you overwrite the
saved return address on the stack and control EIP.
Something I found interesting while researching the history of this bug: the same
programming flaw, triggered from different FTP commands (USER, PASS, HOST,
NOOP...), has ended up registered as several different CVEs
(CVE-2025-5548, CVE-2025-5667, CVE-2025-5220, CVE-2025-5075...).
METHODOLOGY.md — central document: my analysis and exploitation
methodology, phase by phase, with the tools and mindset I apply in each one, and my
approach to an unknown vulnerability (0-day).00-Environment/ — how I set up the lab
(Windows victim, Linux attacker, installed software, network); includes the
vulnerable binary in Binaries/.01-Vulnerability-Analysis/ — binary
diagnosis: where the flaw is and why it occurs, with static reverse engineering.02-Exploitation/ — the complete exploitation
process documented step by step, with the scripts I used at each stage.03-0day-Approach/ — how I would approach the
search for a still undiscovered vulnerability: fuzzing, diffing, reversing,
environment.images/ — lab screenshots, one subfolder per section.All tests have been carried out in an isolated lab (virtual machines on an internal network, no connection to third-party systems). The content is exclusively educational; it is not intended to be used against infrastructure without authorization.
I used as a basis the repository TheMalwareGuardian/CVE-2025-5548.