Recently, I got to learn about enterprise network design in school. I think it is pretty important, so I'm writing it down for future reference.
We start by navigating to ftp.wingdata.htb. Upon inspection, we realize that the version on Wing FTP in use is vulnerable to CVE-2025-47812. We can get a reverse shell using this CVE. After getting the foothold, we perform credential hunting and find password hashes. However, we need to add the relevant salt to the hashes before cracking them. This technique allows us to get the credentials of wacky. Wacky can run a specific python file as sudo. The version of Python is vulnerable to CVE-2025-4330. We can leverage it to run any commands as root.
We start by fuzzing the virtual host of the web server, revealing a hidden portal virtual host. portal.variatype.htb exposed the .git directory, thus, we are able to retrieve credentials from the git history. In order to achieve remote code execution, we take advantage of a arbitrary file write vulnerability in variatype.htb to get a web shell as www-data. There is a backup file that reveals that fontforge is in use. This version of fontforge is vulnerable a remote code execution vulnerability. By placing a malicious crafted file in the target directory, we get a reverse shell as steve. steve has sudo permissions to execute a python file as root. Unfortunately, the setuptools module in use is vulnerable to arbitrary file write, which we use to write a SSH key into the /root/.ssh directory. We can now SSH into the machine as root.
I recently had to research a bit about DevSecOps in GitHub, so no better time than now to revisit GitHub Advanced Security and related security tools.
With the provided credentials, access the file share. In the Logs share, we can view many log files, one of which contains additional credentials. However, we need to change the password a bit and cannot use it straight away. From there, we perform targeted kerberoasting on a service user and retrieve its TGT. We can use it to winrm into the machine. Moving on, we notice a scheduled task. We retrieve the executable to examine it. This allows us to hijack one of their DLLs to get a reverse shell instead. Finally, we combine WSUS, certipy and a method to dynamically update the DNS on a Windows server to get a SYSTEM shell. Yep, it ain't easy.
