CVE-2025-47812 PoC — Wing FTP Server 7.4.3及安全漏洞

Source

https://github.com/r0otk3r/CVE-2025-47812

Associated Vulnerability

Title:Wing FTP Server 7.4.3及安全漏洞 (CVE-2025-47812)
Description:In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

Readme


# CVE-2025-47812 – Wing FTP Server RCE Exploit

**Exploit Title:** Wing FTP Server < 7.4.4 Remote Code Execution via Lua Injection  
**CVE:** [CVE-2025-47812](https://nvd.nist.gov/vuln/detail/CVE-2025-47812)  
 **Tested on:** Wing FTP Server v7.3.x (Windows/Linux)  
**Impact:** Remote Code Execution (RCE) as SYSTEM/root  
**Severity:** Critical

---

## Description

A vulnerability in Wing FTP Server's handling of `\0` (null byte) in login input allows an attacker to **inject arbitrary Lua code** into session files via the user or admin web interface. This can be leveraged to execute system commands on the underlying OS.

- Works **unauthenticated** if anonymous login is enabled.
- Lua injection is triggered via the `username` parameter.
- Command output is extracted from `dir.html` using leaked `UID`.

---

## Features

-  Remote command execution
-  Interactive shell (`-i`)
-  Anonymous access support
-  Proxy support (`--proxy`)
-  Custom credentials
-  Clean, readable output

---

## Usage

```bash
python3 wingftp_cve_2025_47812.py [-h] [-u URL] [--list LIST] [-c COMMAND] [-U USERNAME] [-P PASSWORD] [--proxy PROXY] [-v] [-i]
```
### Example:
```bash
python3 wingftp_cve_2025_47812.py -u "http://192.168.1.10" -c "whoami" -U anonymous -P password --proxy "http://127.0.0.1:8080" -v -i
```
<img width="1902" height="926" alt="Screenshot_2025-07-27_16_32_55" src="https://github.com/user-attachments/assets/3c4aa773-9fc0-4e2e-827a-12ba8627858c" />

---

## Request/Response:

<img width="1920" height="672" alt="Screenshot_2025-07-27_16_33_07" src="https://github.com/user-attachments/assets/608c7aa8-cc33-4175-9451-d06744a861e8" />


<img width="1920" height="672" alt="Screenshot_2025-07-27_16_33_21" src="https://github.com/user-attachments/assets/1e2b300f-0451-4c0d-9057-69f6a4041385" />



## ⚠️ Disclaimer

This exploit script is provided for educational purposes and authorized testing only.
Usage against systems without explicit permission is illegal and unethical.


## Official Channels

- [YouTube @rootctf](https://www.youtube.com/@rootctf)
- [X @r0otk3r](https://x.com/r0otk3r)

File Snapshot


 [4.0K]  /data/pocs/98035b7bd86403a073795b8a535f06a7905c7e15
├── [2.1K]  README.md
└── [6.2K]  wingftp_cve_2025_47812.py

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-47812 PoC — Wing FTP Server 7.4.3及 安全漏洞