---
title: "HTB: WingData"
url: https://daily.dev/posts/htb-wingdata-dj1dfee2w
source_url: https://0xdf.gitlab.io/2026/06/27/htb-wingdata.html
type: article
source: "0xdf hacks stuff"
published: 2026-06-27T14:03:49.101Z
updated: 2026-06-27T14:04:11.356Z
tags: ["security", "python"]
reading_time: 24
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# HTB: WingData

**[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 24 min read · 1 upvotes · 0 comments

## Summary

A detailed walkthrough of the HackTheBox machine WingData, covering two CVE exploits. First, CVE-2025-47812 — a null-byte injection flaw in Wing FTP Server v7.4.3 that smuggles Lua code into session files, enabling RCE via anonymous login. After gaining a shell as wingftp, salted SHA256 password hashes are extracted from Wing FTP's XML config files and cracked with hashcat to pivot to the wacky user. Finally, CVE-2025-4517 — a path-validation bypass in Python 3.12's tarfile 'data' extraction filter using a PATH_MAX overflow trick — is exploited to write an SSH authorized_keys file into /root, achieving full root access.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://0xdf.gitlab.io/2026/06/27/htb-wingdata.html>

## Similar posts on daily.dev

- [HTB: DevArea](https://daily.dev/posts/htb-devarea-og8fxznar) · 0xdf hacks stuff · 0 upvotes · 0 comments
- [HTB: Pterodactyl](https://daily.dev/posts/htb-pterodactyl-z4jqa3rgp) · 0xdf hacks stuff · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python)

[View this post on daily.dev](https://daily.dev/posts/htb-wingdata-dj1dfee2w)