CVE-2025-5548

🛡️ 分析与利用：CVE-2025-5548 网络安全硕士 | 模块 6：漏洞 👋 你好！欢迎来到我的分析工坊 在本仓库中，我记录了自己在二进制级别漏洞分析与Windows环境漏洞利用开发方面的实践探索。 本实验室的主要目标是内化技术方法，从发现内存损坏缺陷（堆栈缓冲区溢出 ）开始，直到利用CVE-2025-5548 实现远程代码执行（RCE ）。 这不仅关乎运行工具，更在于理解内存如何被破坏、如何控制执行流程（EIP寄存器），以及如何绕过限制注入我们自己的Shellcode 。 📂 仓库结构 为了保持项目有序并模拟分析师真实工作流程，我将研究分为两个主要阶段： 🛠️...

CVE-2025-5548

利用实验室 - CVE-2025-5548 FreeFloat FTP 在隔离虚拟机中的 Windows 环境下，针对 FreeFloat FTP 服务器的 CVE-2025-5548 进行受控利用的实验室仓库。 本项目分为两个模块： Environment/：环境准备（工具、IDE、调试器、反汇编器和易受攻击的应用）。 Exploit/：针对 CVE 场景中 FTP 向量（MKD）的完整利用链的实践方法及脚本。 实验目标 构建、验证并记录一个可复现的利用链，覆盖以下内容： 1. 检查连通性和攻击面。 2. 模糊测试并稳定复现崩溃。 3. 控制 EIP 并计算精确偏移量。 4. 识别坏字...

CVE-2025-5548

🧪 FreeFloat FTP Server Buffer Overflow Lab CVE-2025-5548 📌 Descripción Este laboratorio demuestra cómo explotar una vulnerabilidad de Stack Buffer Overflow en FreeFloat FTP Server , identificada como CVE-2025-5548. El objetivo es comprender el proceso completo de explotación en aplicaciones Windo...

CVE-2025-5548

攻破 FreeFloat FTP：CVE-2025-5548 的分析与利用 Anderson Steven —— 网络安全硕士，模块 6（漏洞） 个人提交： 漏洞分析与利用方法论 为什么创建这个仓库 我不想只是提交一份“这是可用的 exploit”。这个仓库 记录的是我面对内存破坏漏洞时的工作方式：先看什么、按什么顺序 排除假设、每个阶段使用哪些工具以及为什么。我用 CVE-2025-5548 作为主线，因为它是一个小而易于把握的案例，但这个仓库的核心文档—— METHODOLOGY.md ——不是“如何利用 FreeFloat FTP”的教程，而是我面对任何二进制文件时的推理方式，...

Backdoor.Win32.WinShell.30 Remote Stack Buffer Overflow / Missing Authentication

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/56a2b135c8d35561ea5b04694155eb77.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.WinShell.30 Vulnerability: Remote Stack Buffer Overflow / Missing Authentication...

Email-Worm.Win32.Zhelatin.ago Remote Stack Buffer Overflow

Discovery / credits: malvuln - Malvuln.com c 2021 Original source: http://malvuln.com/advisory/0418e7f95a8b94c035e10749234f8378.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Email-Worm.Win32.Zhelatin.ago Vulnerability: Remote Stack Buffer Overflow Description: Buffer overflo...

CVE-2019-18931

Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer EIP control via crafted GET/POST parameters...

CVE-2019-18931

CVE-2019-18931 affects Western Digital My Cloud EX2 Ultra firmware up to 2.31.195. The issue is a buffer overflow that enables control of the Extended Instruction Pointer (EIP) via crafted GET/POST parameters. Affected firmware version is stated, but no remediation or patch version is provided in...

ActivePDF Toolkit Code Execution

ActivePDF Toolkit 8.1.0 multiple RCE Introduction ============ The ActivePDF Toolkit is a Windows library which enhances business processes to stamp, stitch, merge, form-fill, add digital signatures, barcodes to PDF. Both .NET and native APIs are provided. Amongst many other operations, this...

Freefloat FTP Server 1.0 - 'SITE ZONE' Command Buffer Overflow

Vulnerability background An ftp server seems to be very small,the feeling should be not many people use this to open the ftp service, but there is a vulnerability, and zoomeye be able to search to a lot of equipment to use the service,and the analysis very simple. Vulnerability details Treatment...

uSQLite 1.0.0 Denial Of Service

!/usr/bin/python Exploit Title: Remote buffer overflow vulnerability in uSQLite 1.0.0 PoC Date: 27/10/1016 Exploit Author: Peter Baris Software Link: https://sourceforge.net/projects/usqlite/?source=directory Version: 1.0.0 Tested on: windows 7 and XP SP3 Longer strings will cause heap based...

Internet Bug Bounty: gdImageTrueColorToPaletteBody allows arbitrary write/read access

Upstream bug report ================ 2016-06-29 04:03 UTC https://bugs.php.net/bug.php?id=72512 Patch ===== 2016-07-19 07:47 UTC http://git.php.net/?p=php-src.git;a=commit;h=928aecc002e906b309b28f0062f03d4e5eda3e45 Fixed for PHP 5.5 security only mode, PHP 5.6, PHP 7.0...

Internet Bug Bounty: EIP control using type confusion in json encoding

https://bugs.python.org/issue24683 File 'eip.py' posted on the issue page proves EIP control...

PHP yaml_parse_url Double Free Vulnerability

The yaml parsing functions suffers from an exploitable double free caused by the error path for the phpvarunserialize call on line 797 of pecl/fileformats/yaml.git/parse.c. Title: PHP yamlparseurl Double Free Credit: John Leitch email protected Url1:...

LanSpy 2.0.0.155 - Buffer Overflow (PoC)

LanSpy 2.0.0.155 - Buffer Overflow PoC ''' + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-LANSPY-BUFFER-OVERFLOW-10052015.txt Vendor: ================================ www.lantricks.com Product: ================================...

Internet Bug Bounty: PHP yaml_parse/yaml_parse_file/yaml_parse_url Double Free

https://bugs.php.net/bug.php?id=69616 Description: ------------ The yaml parsing functions suffers from an exploitable double free caused by the error path for the phpvarunserialize call on line 797 of pecl/fileformats/yaml.git/parse.c: if ISNOTIMPLICITANDTAGISevent, YAMLPHPTAG const unsigned cha...

TestDisk 6.14 - 'Check_OS2MB' Stack Buffer Overflow (PoC)

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. TestDisk 6.14 CheckOS2MB Stack Buffer Overflow Affected versions: TestDisk 6.14 - Linux, Windows and Mac OSX PDF:...

Hero big eye processing of the TGA File format buffer overflow vulnerability, the EIP can be controlled-the vulnerability warning-the black bar safety net

Brief description: Software description: http://baike.baidu.com/view/222352.html Download: http://www.onlinedown.net/soft/2704.htm http://dl.pconline.com.cn/html2/1/114/id=1879&pn=0.html In the processing of the TGA File format when there is a buffer overflow vulnerability, the eip can be...

Malx Media Player handle malformed m3u file stack overflow local arbitrary code execution-vulnerability warning-the black bar safety net

Malx Media Player 3.2.2 handle malformed m3u file will occur when the stack overflows, which can allow an attacker to successfully control EIP, and execute arbitrary code. （Win7 SP1 with MacType for ROP） Malx Media Player is using MAXPATH as initialization parameters on the stack variable, but th...

Python - socket.recvfrom_into() Remote Buffer Overflow

Python - socket.recvfrominto Remote Buffer Overflow !/usr/bin/env python ''' Exploit Title: python socket.recvfrominto remote buffer overflow Date: 21/02/2014 Exploit Author: @sha0coder Vendor Homepage: python.org Version: python2.7 and python3 Tested on: linux 32bit + python2.7 CVE : CVE-2014-19...