WingData

Table of Contents

• Executive Summary
• Reconnaissance
• Initial Access - CVE-2025-47812
• Credential Extraction & Cracking
• User Access
• Privilege Escalation - CVE-2025-4138
• Flags
• Remediation
• Key Takeaways

Executive Summary

WingData is an Easy-rated Linux machine that demonstrates critical vulnerabilities in outdated software. The attack chain exploits two high-severity CVEs:

• CVE-2025-47812 - Unauthenticated Remote Code Execution in Wing FTP Server 7.4.3
• CVE-2025-4138 - Python tarfile PATH_MAX bypass allowing arbitrary file write

The exploitation process involves:

1. Exploiting Wing FTP’s NULL byte handling vulnerability to inject Lua code
2. Extracting and cracking user password hashes (sha256 with salt)
3. Leveraging Python 3.12.3’s tarfile vulnerability to write SSH keys to root’s authorized_keys
4. Obtaining full root access via SSH key authentication

Reconnaissance

Network Scanning

Initial port scan revealed two open services:

# Fast port discovery
sudo nmap -sS -p- --min-rate 10000 -T5 10.129.225.27 -oG ports.txt

# Results
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Service Enumeration

Detailed service fingerprinting identified specific versions:

# Extract discovered ports
ports=$(grep -oP '\d+/open' ports.txt | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')

# Deep enumeration
sudo nmap -sC -sV -A -O -p$ports 10.129.225.27 -oA wingdata_detailed

Key Findings:

Port	Service	Version	Details
22/tcp	SSH	OpenSSH 9.2p1 Debian 2+deb12u7	Standard SSH service
80/tcp	HTTP	Apache httpd 2.4.66	Hosting WingData Solutions website

Operating System: Linux (Debian 12)

---

🔒

Premium Content

The full exploitation walkthrough, privilege escalation, and flags are available exclusively for members.

Unlock Full Writeup →