HackTheBox - WingData
Source: YouTube · IppSec · published Jun 27, 2026 · 42:05
This video demonstrates a full walkthrough of the Hack The Box machine "WingData," highlighting how to exploit a Wing FTP server for initial access, crack salted hashes for user escalation, and leverage a Python tarfile CVE for safe root privilege escalation 0:00-0:58.
Key Takeaways:
• Initial recon reveals an SSH service and an Apache web server hosting a client portal at ftp.wingdata.htb running Wing FTP Server version 7.4.3 1:14-3:17.
• A null byte injection vulnerability (CVE) allows authentication bypass and Lua code execution as the anonymous user, which is leveraged to gain a reverse shell 3:28-9:21.
• Post-exploitation involves dumping Wing FTP's user database, discovering the password salt ("wingftp") in the configuration, and using Hashcat (mode 1410) to crack the "wacky" user's SHA-256 hash 16:01-22:46.
• The "wacky" user can execute a backup script using a locally installed Python 3.12 binary, which is vulnerable to a path-traversal bug in the tarfile module 23:01-25:35.
• Instead of blindly overwriting root's SSH keys, the presenter safely escalates to root by writing a new file to /etc/sudoers.d/ using the tarfile path-traversal exploit 32:08-39:57.
The walkthrough effectively emphasizes the importance of understanding password salting, avoiding destructive file overwrites during privilege escalation, and safely leveraging known CVEs.
Sources:
- 0:00-0:58 Overview of the WingData attack chain
- 3:28-9:21 Exploiting Wing FTP null byte injection for RCE
- 20:40-22:46 Finding the password salt and cracking the hash
- 25:35-28:21 Identifying the Python 3.12 tarfile CVE
- 38:08-39:57 Safely escalating to root via sudoers.d
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today we'll be doing WingData from Hack The Box, which is an easy box, but the recon can be a little bit tricky. It starts off with finding a Wing FTP server that declares its version, and there's a POC available, so it's super easy to get a shell on the box. However, after that, it can be a little bit tricky cuz you have to crack the password hash, which sounds easy, but Wing FTP does put a salt on the password, and if you don't know that, you just spin your wheels constantly trying to crack a password that never cracks. So, once you find the salt either in the documentation or the config files, you'll get access to the wacky user, and this user can execute a Python script, but the odd thing is the Python binary is in user local bin, which is t…