dreadnaught- Machine
- WingData
- OS
- Linux
- Difficulty
- Easy
- Steps
- 3
- Added
- 14 Feb 2026
A Wing FTP null-byte auth bypass (CVE-2025-47812) gives a shell; a cracked salted hash pivots to wacky, and a sudo tarfile bypass (CVE-2025-4517) writes a root SSH key.
How it went
- 0nmap
nmap shows SSH and Apache; an ftp. vhost serves Wing FTP Server 7.4.3.
- 1Wing FTP RCE
A null-byte username (CVE-2025-47812) bypasses auth and runs Lua, giving a shell as wingftp.
- 2wacky
A salted SHA-256 user hash cracks from rockyou, letting su to wacky.
- 3tarfile bypass
wacky may sudo a tarfile restore script on Python 3.12.3; CVE-2025-4517's PATH_MAX symlink bypass writes authorized_keys into /root for SSH as root.