CVE Research on Hackpuntes

WingData WriteUp

Sat, 27 Jun 2026 00:00:00 +0000

WingData is an 🟩 Easy difficulty machine on Hack The Box, Season 10, created by WackyH4cker. The attack chain combines exploiting a vulnerable Wing FTP Server for initial access, extracting and cracking credentials from configuration files, and privilege escalation through a vulnerability in Python’s tarfile module.

🗺️ Attack Chain

Reconnaissance → Port 80 + 22
│
▼
Web enumeration → ftp.wingdata.htb (Wing FTP Server v7.4.3)
│
▼
CVE-2025-47812 → Unauthenticated RCE → Shell as wingftp
│
▼
/opt/wftpserver/Data/1/users/wacky.xml → Salted SHA-256 hash
│
▼
Hashcat (mode 1410) → Plaintext password → SSH as wacky
│
▼
sudo -l → restore_backup_clients.py (root) → CVE-2025-4517
│
▼
Malicious tar → path traversal → /etc/sudoers → root 🏴

🔍 Reconnaissance

/etc/hosts Setup

Before we start, we add the machine IP to /etc/hosts so we can use the domain name across all tools:

VariaType WriteUp

Sat, 13 Jun 2026 00:00:00 +0000

VariaType is a 🟧 Medium difficulty machine on Hack The Box, Season 10. The attack chain starts by discovering an exposed Git repository on an internal portal, extracting credentials from the commit history, exploiting an arbitrary file write in fontTools to get a shell, moving laterally by abusing command injection in FontForge via a malicious ZIP file, and escalating to root by leveraging a path traversal in setuptools through a misconfigured sudo rule.

Interpreter WriteUp

Sat, 30 May 2026 00:00:00 +0000

Interpreter is a 🟨 Medium difficulty machine from the Hack The Box platform, Season 10. The attack chain combines the exploitation of Mirth Connect 4.4.0 through insecure Java deserialization to obtain unauthenticated RCE, extraction of credentials from the internal database, cracking of a PBKDF2-HMAC-SHA256 hash, and privilege escalation by abusing a Flask service with Python f-string injection.

🗺️ Attack Chain

Reconnaissance → Ports 22, 80, 443
│
▼
Web Enumeration → Mirth Connect 4.4.0 (via JNLP)
│
▼
CVE-2023-43208 → Insecure Java Deserialization → RCE as mirth
│
▼
/usr/local/mirthconnect/conf/mirth.properties → DB Credentials
│
▼
MariaDB (mc_bdd_prod) → PBKDF2-HMAC-SHA256 hash of sedric
│
▼
Hashcat (mode 10900) → snowflake1 → SSH as sedric
│
▼
/usr/local/bin/notif.py → Flask + eval() in f-strings → SSTI
│
▼
SUID bash → root 🏴

🔍 Reconnaissance

/etc/hosts Configuration

Before starting, we add the machine’s IP to the /etc/hosts file:

MonitorsFour WriteUp

Sat, 23 May 2026 00:00:00 +0000

MonitorsFour is an 🟩 Easy difficulty machine on the Hack The Box platform. The attack chain starts by exploiting an IDOR endpoint with PHP loose comparison to leak administrator credentials, continues with remote code execution in Cacti 1.2.28 via CVE-2025-24367, and ends by escaping the Docker container by abusing the daemon API exposed without authentication on the internal Docker Desktop subnet (CVE-2025-9074).

🗺️ Attack Chain

Reconnaissance → Ports 80, 5985
│
▼
Subdomain enumeration → cacti.monitorsfour.htb
│
▼
IDOR + PHP Type Juggling → /api/v1/user?token=0 → MD5 hash → marcus:wonderful1
│
▼
CVE-2025-24367 → Cacti 1.2.28 authenticated RCE → www-data in Docker container
│
▼
user.txt → /home/marcus/user.txt
│
▼
CVE-2025-9074 → Docker API on 192.168.65.7:2375 → container with C:\ mounted → root 🏴

🔍 Reconnaissance

/etc/hosts Setup

echo "10.129.38.79 monitorsfour.htb" | sudo tee -a /etc/hosts

Port Scanning

Phase 1 - Fast TCP port discovery: