Authenticated RCE in Wing FTP Server 8.1.2 Session Serialization

This repository is a small, focused exploit PoC for an authenticated RCE in Wing FTP Server v8.1.2 caused by unsafe Lua session serialization and subsequent execution via loadfile(). It contains two files: a README describing the vulnerability and exploitation chain, and a Python script (session_poisoning_poc.py) that automates exploitation. The exploit targets the Wing FTP web admin interface. It logs in with valid full administrator credentials, then abuses the vulnerable admin-management functionality to create a domain admin account whose mydirectory/basefolder field contains a crafted Lua breakout sequence using ']]<lua>--'. When that poisoned domain admin logs in, the malicious basefolder is copied into session variables such as admin_basefolder and admin_nowpath. On a later request, Wing FTP reloads the session file as Lua code, causing the injected payload to execute with the privileges of the Wing FTP service account (SYSTEM on Windows or root on Linux, per the README). The Python exploit is operational rather than just demonstrative: it supports a demo mode and an exploit mode, uses requests.Session for HTTP state handling, disables TLS verification warnings, authenticates to /service_login.html, and attempts to create a poisoned admin through /service_add_admin.html. The script’s default payload is a Lua os.execute command that writes the output of whoami to C:\wingftp_pwned.txt, though the README also shows similar proof-file payloads such as C:\proof.txt and C:\wingftp_rce_proof.txt. The exploit relies on the target exposing the admin panel, typically on port 5466, and on the attacker having sufficient admin privileges to add or modify domain admins. Overall purpose: authenticated remote code execution through session poisoning, not detection. The repository does not appear to belong to a larger exploit framework.