Ünsal Furkan Harani
Source-scoped identity with 3 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
ExploitDBWing FTP Server 8.1.3 - Authenticated Remote Code Execution
ExploitDB exploitPublished 2026-05-29ExploitCVE-2026-444031 file
Analysis
Technical assessment
Python script that authenticates to Wing FTP Server as an administrator, creates or modifies a domain admin with a poisoned 'mydirectory' field containing Lua code, and triggers remote code execution by logging in as that poisoned admin to force the server to load and execute the injected Lua payload via loadfile().
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward authenticated RCE exploit for Wing FTP Server. It uses the documented vulnerability to inject Lua code via the mydirectory field, creates a poisoned admin account, and triggers execution by logging in. No concealed backdoor, unrelated payload, or deceptive behavior is present. The default payload writes a proof file, and the code is fully readable Python with no obfuscation.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by authenticating, injecting a Lua payload into the server's session serialization, and triggering its execution to achieve remote code execution. It includes a complete exploit chain with login, payload injection, and trigger steps.
exploits/multiple/remote/52589.txt:244-296Requirements
- Valid full admin credentials for the Wing FTP Server web admin panel
exploits/multiple/remote/52589.txt:16-18 - Target Wing FTP Server version <= 8.1.2
exploits/multiple/remote/52589.txt:8-9
Observed behavior
- Authenticates to the admin panel via POST to /service_login.html
exploits/multiple/remote/52589.txt:41-70 - Creates a new domain admin with a poisoned 'mydirectory' field containing a Lua payload that breaks out of a long string delimiter
exploits/multiple/remote/52589.txt:72-125 - If the admin already exists, modifies the existing admin to inject the poisoned basefolder
exploits/multiple/remote/52589.txt:127-161 - Logs in as the poisoned domain admin to store the poisoned session, then makes a subsequent request to trigger loadfile() and execute the injected Lua code
exploits/multiple/remote/52589.txt:163-202 - Default payload executes 'whoami > C:\wingftp_pwned.txt' on the server
exploits/multiple/remote/52589.txt:271-272
Behaviors behind the backdoor verdict
Observables
- Default Payload
- Payload withheldThe default payload writes a proof-of-execution file, consistent with a benign PoC demonstration.
exploits/multiple/remote/52589.txt:272 - Demo Payload
- Payload withheldThe demo mode shows a similar benign proof-of-execution payload, reinforcing the PoC's educational intent.
exploits/multiple/remote/52589.txt:213 - Persistence Claim
- Payload withheldThe PoC documentation notes that the injected payload persists in the session file, which is a natural consequence of the vulnerability, not a separate backdoor mechanism.
exploits/multiple/remote/52589.txt:22
What the analysis did not establish
- The analysis is based solely on the supplied text file; the code was not executed, and its effectiveness or safety is not verified.
- The script does not handle TOTP-based two-factor authentication (line 59).
- The default payload writes to a Windows path (C:\wingftp_pwned.txt) but the demo and some comments reference /tmp/, which may indicate cross-platform assumptions.
- Only the supplied text file was reviewed; no binary files or external resources were inspected.
- The review does not assess the safety of executing the PoC against a live target, which would perform the described RCE.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.