Status Report: WingData Pentest

Goal

Privilege escalation from user wacky to root on the WingData machine (10.129.190.143).

Current Status

Success! The root flag has been retrieved.

Findings & Exploitation Flow

1. Initial Access (User: wacky)

• Service: SSH (Port 22).
• Credentials: wacky:!#7Blushing^*Bride5.
• User Flag: 6e3e271dc8fae5af3a7adfc25cdb2dc9 (found in /home/wacky/user.txt).

2. Privilege Escalation (User: root)

• Discovery:
  • sudo -l revealed that wacky could run /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py * as root without a password.
  • The script uses tarfile module to extract archives provided by the user.
  • The script explicitly sets filter='data' (Python 3.12+), which is intended to prevent standard path traversal attacks (e.g., ../).
  • Attempts at simple traversal (../../etc/passwd), library hijacking (PYTHONPATH), and argument injection were blocked by the filter or environment restrictions.
• Exploitation (CVE-2024-12718 / Tarfile Bypass):
  • Vulnerability: A logic flaw in tarfile's path resolution (specifically involving deep directory structures and symlinks) allows bypassing the data filter in certain Python versions (including 3.12.3). By crafting a tar archive with interleaved symlinks and directories, an attacker can trick the filter into resolving a path as safe while it actually points outside the extraction directory.
  • Exploit Method:

    1. Generated an SSH key pair (root_key) in /tmp.

    2. Created a Python script on the target to generate a malicious tar archive (backup_9999.tar) in /opt/backup_clients/backups/.

    3. The archive contained a specific structure: deeply nested directories and symlinks leading to an escape symlink that pointed to /root/.ssh/authorized_keys.

    4. Executed the vulnerable script via sudo:

       sudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py -b backup_9999.tar -r restore_poc
       

    5. The exploit successfully wrote the generated public key to /root/.ssh/authorized_keys.

  • Root Access: SSHed into localhost as root using the generated private key.
  • Root Flag: c3fe8a8e84a183701925521af50fbb4c.

Artifacts Created

• /tmp/root_key (Private SSH Key)
• /tmp/root_key.pub (Public SSH Key)
• /tmp/pwn_tar.py (Exploit Generator Script)
• /opt/backup_clients/backups/backup_9999.tar (Malicious Archive)
• /opt/backup_clients/restored_backups/restore_poc (Extraction Directory)

Clean Up (Pending)