WingData is an easy Linux machine published during the 10th Hack the Box Season (Season of the Underground). As usual, the first step is to run our nmap scan.

nmap scan

As we can see, we got two open ports, 22 for ssh and 80 for an HTTP server. We can update our /etc/hosts file to visit the page directly.

hosts

By clicking on Client Portal, we are redirected to a login page that shows the version of Wing FTP Server.

hosts

As you can see, the version is 7.4.3 and a quick search on Exploit Database clearly shows that is vulnerable to Unauthenticated Remote Code Execution.

exploit-db

From there, a quick search on Metasploit shows that there is a module ready to use.

metasploit

Quick set of the options (basically Remote Host, Virtual Host and Local Host).

metasploit-options

And now let the magic begin.

run-exploit

An exploration of the different files and folders will lead us to the golden nuggets.

hashes

salt

At this point, it’s time to unleash hashcat.

hashcat

And let’s finish by collecting the user flag using the credentials we’ve just obtained.

ssh

I did not documented the privilege escalation steps, but once you’re in it shouldn’t be to difficult. Hope you’ve enjoyed my first writeup!