HTB WingData Wing FTP Null-Byte Lua RCE, Hash Cracking, and ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/06/27/htb-wingdata.html
• Blog Title: HTB WingData: Wing FTP Null-Byte Lua RCE, Hash Cracking, and Python tarfile Privilege Escalation
• Suggested Section: Network Services Pentesting -> 80,443 - Pentesting Web Methodology -> Wing FTP Server; also cross-reference Generic Hacking -> Archive Extraction Path Traversal and Linux Privilege Escalation -> Arbitrary File Write to Root

🎯 Content Summary

The blog is a HackTheBox WingData walkthrough chaining two real CVEs and one credential-reuse pivot on a Linux host. The attack path is: discover a hidden Wing FTP virtual host, exploit CVE-2025-47812 in Wing FTP Server v7.4.3 to inject Lua into a session file and obtain RCE as wingftp, recover salted Wing FTP password hashes from XML files, crack the wacky user hash with Hashcat, then abuse a sudo-allowed Python backup restore script vulnerable t...

🔧 Technical Details

Wing FTP null-byte Lua session injection: In Wing FTP Server before 7.4.4, username validation in the web interface treats \0 as the end of the username, but the full submitted username is written into a Lua session file. If an attacker can authenticate with any valid account, including anonymous with a blank password when anonymous access is enabled, they can submit a username like anonymous\0]] ... Lua code ... --. The valid prefix passes authentication, ]] closes the Lua long string in _SESSION['username']=[[...]], attacker Lua such as io.popen("id") executes when a page is loaded with the session cookie, and -- comments out the trailing syntax. Triggering a page such as /dir.html with the malicious cookie executes commands as the Wing FTP service account. This is CVE-2025-47812 and may be root/SYSTEM RCE if the service runs with default high pr...

🤖 Agent Actions

Continued the run and finished another sanity pass.

Confirmed:

• the new Wing FTP section exists only once in the repo
• only src/network-services-pentesting/pentesting-ftp/README.md is modified
• there are no diff-check whitespace/errors
• the inserted section stays scoped to Wing FTP and does not duplicate the tarfile / authorized_keys privilege-escalation content

The repository state remains clean and ready for final completion later.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/06/27/htb-wingdata.html

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting -> 80,443 - Pentesting Web Methodology -> Wing FTP Server; also cross-reference Generic Hacking -> Archive Extraction Path Traversal and Linux Privilege Escalation -> Arbitrary File Write to Root".

Repository Maintenance:

• MD Files Formatting: 981 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0