tenor-z/cve-2025-4255---buffer-overflowExploit framework targeting CVE-2025-4255, a buffer overflow vulnerability, providing a structured environment for developing and testing exploits.
A comprehensive proof-of-concept exploit tool suite, and cross-platform analysis targeting PCMan FTP Server v2.0.7 [CVE-2025-4255].
This repository documents the progress and efforts required to discover a protocol crash, calculate raw memory alignment boundaries, and execute controlled instruction redirection natively on Windows XP, alongside local Denial of Service (DoS) constraints on Windows 2000, and defensive containment mitigation barriers on Windows 11.
The repository is structurally decoupled into individual scripts mapping to each specific phase of the exploit development lifecycle:
patterngen.py – Dynamically constructs a 2400-byte unique, non-repeating cyclic sequence (Aa0Aa1...) and outputs it to a file pattern.txt.fuzzer.py – The main fuzzer used. Pulls data from pattern.txt to safely trigger a protocol buffer overflow inside a target debugger environment.calculateoffset.py – Reads pattern.txt directly to analyze captured register values and locate the exact overflow ceiling.exploit.py – The actual constructed exploit, featuring custom payload delivery arrays for target environments.The buffer overflow vulnerability resides within the handling logic of the RMD (Remove Directory) FTP command string parser. The application implements an unsafe, unbounded string copying mechanism (such as strcpy) when loading a directory path argument into memory. Because the application fails to validate the size of user input before moving it into a pre-defined stack buffer space, an oversized parameter induces a classic Stack-Based Buffer Overflow (CWE-121).
Data systematically cascades past the destination buffer frame, blowing through local storage, overwriting the Saved Frame Pointer (EBP), and completely filling the Extended Instruction Pointer (EIP). By seizing EIP, a remote attacker can dictate the target CPU's exact execution vector.
Initial fuzzing scripts isolated a predictable application collapse on the RMD parameter when the string input payload size scaled between 2100 and 2300 bytes.
To isolate the precise character edge controlling the execution path, patterngen.py was used to inject a unique sequence. Inside the x32dbg environment, the application crashed with a precise register state:
7043396FAccounting for 32-bit x86 Little-Endian architecture, reversing the hex bytes yields 6F 39 43 70, which maps directly to the ASCII text string o9Cp. Running findoffset.py against the tracking file pinpointed the precise layout boundary configuration:
[\text{Exact Buffer Offset} = \mathbf{2008 \text{ bytes}}]
[ 2008 Bytes of Padding (A) ] [ 4-Byte JMP ESP ] [ NOP Sled ] [ Shellcode Payload ]
^
|-- Overwrites EIP cleanly at byte 2009
For a more comprehensive analysis, please read the DISCOVERY.MD file
FTP network socket managers interpret specific bytes as protocol operations. To prevent premature string truncation mid-transmission, the following Bad Characters were completely scrubbed from all custom instruction arrays:
\x00 (Null Byte / String Terminator)\x0a (Line Feed / New Line)\x0d (Carriage Return)To pivot across shifting stack spaces, code redirection relies on a static JMP ESP address (0x74e32fd9). When the vulnerable function hits its return phase, EIP reads the jump address, bounces execution straight into the Stack Pointer (ESP) segment, glides down a minor stabilizing NOP sled (\x90 * 20), and runs the payload cleanly.
Vulnerability payload stability is heavily dictated by operating system memory management layers. This script framework was systematically evaluated across three distinct computing eras:
msfvenom payload structures encounter strict API layout desynchronization against legacy Winsock (ws2_32.dll) sub-layers, causing the execution thread context to collapse before initializing an outbound socket channel back to the listener.x32dbg harness due to debugger hook overrides, running natively triggers hardened OS defenses. Modern kernel wrappers (SEHOP and hardware-enforced DEP/NX) actively intercept execution inside data-flagged stack sectors, killing the process instantly to neutralize the memory corruption attempt.blowfish.dll) can be targeted.To resolve the root vulnerability completely, software developers must switch from unverified memory copies to secure, bounded alternatives that strictly validate target container boundaries:
// ❌ WHAT NOT TO DO - Unbounded string copy
void handle_rmd_command(char *user_input) {
char directory_buffer[2000];
strcpy(directory_buffer, user_input); // Copies data blindly until a null byte, spilling over the stack
}
// ✅ SECURE CODE - Bounded string copy
void handle_rmd_command(char *user_input) {
char directory_buffer[2000];
// Restricts copying properties to the maximum capacity of the destination array
// It ensures data copied does not exceed the pre-allocated buffer
strncpy(directory_buffer, user_input, sizeof(directory_buffer) - 1);
directory_buffer[1999] = '\x00'; // Guarantees explicit null-termination
}
This repository is established strictly for educational validation, academic research, and defensive threat modeling. Running exploit code against unauthorized environments without explicit permission is strictly illegal.