Hack The Box Arsenal

6 TIERS (EASY TO PRO LABS)19 MACHINES & LABS

ACTIVE DIRECTORY DEEP DIVE

PRO LAB OPERATOR

Hack The BoxT1068 - Exploitation for Privilege EscalationHTB Easy: WingData — SSH wacky → CVE-2025-4517 tarfile PATH_MAX → Root SSH Key Injection

BeginnerEasy Machine/OS: Linux/+20 PTS/Duration: 30 mins

1. Mission Brief & Target Topology

EXECUTIVE ADVERSARIAL SUMMARY

Compromise of WingData using known wacky SSH credentials followed by local root privilege escalation via CVE-2025-4517 (Python tarfile PATH_MAX extraction directory escape). A sudo backup restore script extracts a crafted archive that drops an SSH key directly into /root/.ssh/authorized_keys.

OFFICIAL ARSENAL EXPLOIT SCRIPT

Bhanu Guragain (@Bh4nu) · Public GitHub Repository

Get wingdata.sh

Quick Clone & Execution Command:

git clone https://github.com/BhanuGuragain0/Offensive_Security_Arsenal.git && cd Offensive_Security_Arsenal/Hack_The_Box && chmod +x wingdata.sh && ./wingdata.sh

Associated CVEs:CVE-2025-4517

TARGET ENVIRONMENT SPECIFICATION

TARGET HOST / SCOPEwingdata.htb

SYSTEM ARCHITECTUREx86_64 Linux (Debian 12)

INITIAL ACCESS VECTORSSH login with credentials wacky:!#7Blushing^*Bride5

PRIVILEGE ESCALATIONsudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py (CVE-2025-4517 tarfile symlink escape)

Prerequisites & Environment Setup:

HTB VPN Connected (ip -4 addr show tun0)

Local tools: openssh-client, python3

/etc/hosts entry: <TARGET_IP> wingdata.htb

Credentials: wacky : !#7Blushing^*Bride5

Exposed Network Services:

22/tcp (OpenSSH 9.2p1)

EXERCISED OPERATOR SKILLS:

tar PATH_MAX OverflowSSH Key InfiltrationSudo Wildcard AbuseSymlink Extraction Escapes

2. Operational Kill Chain Phases (3 Phases)

STEP 01Initial Access via Hardcoded SSH Credentials

Phase 1: SSH Foothold as wacky

Objective:Authenticate over SSH port 22 as user wacky and read user.txt.

COMMAND

ssh -o StrictHostKeyChecking=no wacky@wingdata.htb

Captured Telemetry Evidence:

EVIDENCE STEP 01

[+] Connection established! User wacky authenticated. user.txt: e7b2f...81a

OPSEC & EVASION INSIGHT:Standard SSH session leaves only auth.log entries; no abnormal network anomalies generated.

STEP 02Crafting Deep Directory Structure for CVE-2025-4517

Phase 2: Malicious Archive Generation

Objective:Generate an RSA keypair in /tmp and construct a tar archive containing 247-char path depths plus symlinks pointing to /root/.ssh.

COMMAND

python3 -c "import os, tarfile, shutil; ... # generates malicious backup_1337.tar in /opt/backup_clients/backups/"

Captured Telemetry Evidence:

EVIDENCE STEP 02

[+] Malicious tarball created at /opt/backup_clients/backups/backup_1337.tar with target symlink to /root/.ssh.

OPSEC & EVASION INSIGHT:Creating payloads in /tmp and /opt allows writing within user-writable backup drop zones.

STEP 03Triggering Sudo Restore Script & Logging In as Root

Phase 3: Sudo Restore Execution & Root SSH Key Injection

Objective:Run the restore backup script with sudo to trigger PATH_MAX overflow and drop authorized_keys into /root/.ssh.

COMMAND

sudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py
ssh -i /tmp/id_rsa root@localhost "cat /root/root.txt"

Captured Telemetry Evidence:

EVIDENCE STEP 03

[✓] Root flag retrieved: 4f89c...901. Root session active.

OPSEC & EVASION INSIGHT:SSH login over loopback (localhost) prevents external alert generation from root remote logins.

3. Telemetry, Forensics & Shell Evidence

NETWORK & HOST TELEMETRY FOOTPRINT

Process creation: sudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py

File creation: /root/.ssh/authorized_keys modified outside package manager

4. Blue Team Detection & Defense Playbook

PRODUCTION SIGMA DETECTION RULE

title: Sudo Tarfile Path Traversal Root Escalation
status: production
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage: "/usr/bin/sudo"
    CommandLine|contains: "restore_backup_clients.py"
  condition: selection

DEFENSIVE REMEDIATION & HARDENING

Update Python to version >= 3.12.4 with built-in tarfile data filters enabled.
Ensure /root/.ssh permissions are strictly 700 with immutable attribute (chattr +i).
Audit sudoers configuration to restrict restore scripts to non-wildcard arguments.

CORE OPERATIONAL LESSONS LEARNED

tarfile extraction without safe filters = symlink-escape class (patch Python >= 3.12.4).
sudo entries are the primary attack surface: one writable directory + one sudo line = full chain.
Backup and restore scripts trust archive contents — always validate and canonicalize paths server-side.

Lead Operator: Bhanu Guragain (@Bh4nu)

Related Academy Track Launch Range