Walkthrough of HackTheBox WingData machine — from Wing FTP Server NULL byte Lua injection to root via Python tarfile filter=“data” PATH_MAX bypass