$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: Full HackTheBox machine with Wing FTP Server v7.4.3. Solution: CVE-2025-47812 unauthenticated RCE via NULL byte injection in username for initial access, SHA-256 salted hash cracking for user credentials, then CVE-2025-4517 Python tarfile data filter PATH_MAX bypass for privilege escalation to root.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Full machine on HackTheBox. Wing FTP Server v7.4.3 with CVE-2025-47812 vulnerability (unauthenticated RCE via NULL byte injection in username) for initial access, then cracking SHA-256 salted hashes from Wing FTP configs, and privilege escalation via CVE-2025-4517 — Python tarfile data filter bypass through PATH_MAX overflow.
| # | Type | Flag | Method |
|---|---|---|---|
| 1 | User | 79fe504bb3f54818c9b9179031c1957c | SSH as wacky (cracked Wing FTP hash) |
| 2 | Root | e7f9f385b134b649752bc7ef5fb10f45 | CVE-2025-4517 tarfile PATH_MAX → SSH key injection |
nmap -sV -sC -T4 -p- --min-rate=1000 10.129.4.210
Open ports:
wingdata.htbInternal ports (discovered after initial access):
wingdata.htb — corporate site "WingData Solutions"http://ftp.wingdata.htb/Wing FTP Server versions before 7.4.4 have a critical vulnerability CVE-2025-47812 — unauthenticated RCE via NULL byte injection in the username parameter during login.
Exploitation mechanism:
c_CheckUser() function uses strlen(), which truncates the string at NULL byte (%00). If you pass anonymous%00<lua_code>, authentication passes as user anonymous....
$ grep --similar