WingData runs a Wing FTP Server instance with anonymous access enabled. I’ll abuse a null-byte injection flaw in the web interface that smuggles Lua code into the session file, giving remote code execution and a shell. From there, I’ll find Wing FTP’s account files holding salted password hashes, crack one, and reuse it to move to the next user. That user can run a Python backup-restore script as root that unpacks tar archives using the tarfile module’s “data” extraction filter. I’ll exploit a path-validation bypass in that filter to write outside the extraction directory and drop a key into the root account for full access.

0xdf hacks stuff

A detailed walkthrough of the HackTheBox machine WingData, covering two CVE exploits. First, CVE-2025-47812 — a null-byte injection flaw in Wing FTP Server v7.4.3 that smuggles Lua code into session files, enabling RCE via anonymous login. After gaining a shell as wingftp, salted SHA256 password hashes are extracted from Wing FTP's XML config files and cracked with hashcat to pivot to the wacky user. Finally, CVE-2025-4517 — a path-validation bypass in Python 3.12's tarfile 'data' extraction filter using a PATH_MAX overflow trick — is exploited to write an SSH authorized_keys file into /root, achieving full root access.

HTB: WingData