# WingData Writeup - HackTheBox

> Exploiting a Windows machine via exposed data in a web app, leveraging SQL injection and weak credentials to gain a foothold and escalate privileges.

- **URL:** https://hackindex.io/writeups/wingdata
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Windows
- **Machine:** https://hacktheboxltd.sjv.io/wingdata
- **Tags:** sql-injection
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Discovery

Initial TCP scan shows:

```bash
scan_tcp_full $TARGET_IP 
# [+] Discovering all open TCP ports...
# Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-14 20:08 +0100
# Nmap scan report for $TARGET_IP
# Host is up (0.014s latency).
# Not shown: 65533 filtered tcp ports (no-response)
# Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
# PORT   STATE SERVICE
# 22/tcp open  ssh
# 80/tcp open  http
#
# Nmap done: 1 IP address (1 host up) scanned in 126.57 seconds
# [+] Parsing open TCP ports...
# [+] Running scripts & versions on TCP ports: 22,80
# Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-14 20:11 +0100
# Nmap scan report for wingdata.htb ($TARGET_IP)
# Host is up (0.012s latency).
#
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
# | ssh-hostkey: 
# |   256 a1:fa:95:8b:d7:56:03:85:e4:45:c9:c7:1e:ba:28:3b (ECDSA)
# |_  256 9c:ba:21:1a:97:2f:3a:64:73:c1:4c:1d:ce:65:7a:2f (ED25519)
# 80/tcp open  http    Apache httpd 2.4.66
# |_http-title: WingData Solutions
# Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel
#
# Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done: 1 IP address (1 host up) scanned in 13.46 seconds
```

We see that HTTP port 80 is open so we check the response with:

```bash
curl http://$TARGET_IP
# <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
# <html><head>
# <title>301 Moved Permanently</title>
# </head><body>
# <h1>Moved Permanently</h1>
# <p>The document has moved <a href="http://wingdata.htb/">here</a>.</p>
# <hr>
# <address>Apache/2.4.66 (Debian) Server at $TARGET_IP Port 80</address>
# </body></html>
```

With this output I know I have to add the domain to our hosts file with:

```bash
addhost $TARGET_IP wingdata.htb                 
# [+] Added: $TARGET_IP → wingdata.htb
```

Related

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.