skip to content
~/bokkapig
_
hack the box machine writeups
[1]
machines
[2]
refs
[3]
cheatsheet
[4]
search
[5]
pdf-inject
← cd ../tags
grep -l "Lua Injection" ./machines
[1]
sorted: date ▼
$ grep
/
difficulty
easy
clear ✕
name
diff
os
date
tags
WingData
easy
linux
2026-02-14
Unauthenticated RCE in Wing FTP Server v7.4.3 via NULL byte Lua injection (CVE-2025-47812), lateral movement through cracked FTP user password hash, and root via Python tarfile data filter PATH_MAX bypass (CVE-2025-4517).
wing ftp server
·
cve-2025-47812
·
lua injection
·
password cracking
·
hashcat
·
tarfile filter bypass
·
+3
no machines match that filter