WingData — HTB Writeup | The Hack Sparrow

Executive summary — WingData is an Easy Linux box that chains two real 2025 CVEs: an unauthenticated RCE in Wing FTP Server (CVE-2025-47812, listed on CISA's Known Exploited Vulnerabilities Catalog) for the initial shell, and an arbitrary file write in Python's tarfile module (CVE-2025-4517) to jump from a tightly scoped sudo rule to full root. In between, a password hash cached in the FTP server's own configuration is cracked offline and reused over SSH/su. A Web → RCE (Lua) → SSH → tar/sudo → Root path.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.244.106`

Attack map

[80] wingdata.htb → Client Portal → ftp.wingdata.htb
   │  Wing FTP Server 7.4.3 · CVE-2025-47812 (null-byte → Lua RCE, unauth)
   ▼
[SHELL]  wingftp
   │  /opt/wftpserver/.../wacky.xml → hash → offline crack
   ▼
[SSH]  wacky   (user.txt)
   │  sudo -l → NOPASSWD python3 restore_backup_clients.py *
   ▼
[TAR]  the script calls tar.extractall() · CVE-2025-4517 (arbitrary write)
   ▼
[ROOT]  sudoers for wacky → sudo /bin/bash

1. Reconnaissance

Version detection and default scripts against every port:

nmap -sCV -A 10.129.244.106

22/tcp  open  ssh    OpenSSH
80/tcp  open  http   Apache

Only two open ports, so the attack surface is tight: either port 80 hides more than it shows, or SSH needs credentials we don't have yet. Time to dig into the web server.

Port 80 redirects to http://wingdata.htb instead of answering on the bare IP, which gives away virtual hosting: Apache is serving different content based on the Host header, and there's likely more than one hostname configured that we don't know about yet.

Resumen ejecutivo — WingData es una máquina Linux Easy que encadena dos CVE reales de 2025: una RCE no autenticada en Wing FTP Server (CVE-2025-47812, en el Known Exploited Vulnerabilities Catalog de CISA) para conseguir el primer shell, y una escritura arbitraria de ficheros en el módulo tarfile de Python (CVE-2025-4517) para saltar de un usuario con sudo muy acotado a root completo. En medio, un hash de contraseña cacheado en la configuración del propio FTP se crackea offline y se reutiliza por SSH/su. Recorrido Web → RCE (Lua) → SSH → tar/sudo → Root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.244.106`

Mapa del ataque

[80] wingdata.htb → Client Portal → ftp.wingdata.htb
   │  Wing FTP Server 7.4.3 · CVE-2025-47812 (null-byte → Lua RCE, sin auth)
   ▼
[SHELL]  wingftp
   │  /opt/wftpserver/.../wacky.xml → hash → crackeo offline
   ▼
[SSH]  wacky   (user.txt)
   │  sudo -l → NOPASSWD python3 restore_backup_clients.py *
   ▼
[TAR]  el script hace tar.extractall() · CVE-2025-4517 (escritura arbitraria)
   ▼
[ROOT]  sudoers para wacky → sudo /bin/bash

1. Reconocimiento

Escaneo con detección de versiones y scripts por defecto contra todos los puertos:

nmap -sCV -A 10.129.244.106

22/tcp  open  ssh    OpenSSH
80/tcp  open  http   Apache

Solo dos puertos abiertos, así que la superficie de entrada está muy acotada: o algo en el puerto 80 esconde más de lo que parece, o SSH necesita credenciales que aún no tenemos. Toca mirar el 80 a fondo.

El puerto 80 redirige a http://wingdata.htb en vez de responder por IP, lo que delata virtual hosting: Apache está sirviendo contenido distinto según la cabecera Host, y probablemente hay más de un nombre de dominio configurado que aún no conocemos.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.