HackTheBox – Giveback Walkthrough | WordPress, Ligolo-ng, PHP-CGI, Kubernetes Escape

Описание: In this HackTheBox machine, we exploit a WordPress GiveWP plugin vulnerability (CVE-2024-5932) for initial RCE, discover we're in a Kubernetes environment, pivot using Ligolo-ng to access internal services, exploit PHP-CGI argument injection (CVE-2024-4577) in a legacy intranet pod, enumerate Kubernetes API using service account tokens, and finally escape the container by exploiting runc CVE-2024-21626 to achieve root access on the host. This machine covers cloud-native security, container breakouts, and advanced pivoting techniques. If you're learning Kubernetes security, cloud pentesting, OSCP, or just love seeing machines get popped... this one's for you.

📂 Scripts and Commands:
https://github.com/strikoder/CTFS/blo...

🏠 Room Link:
https://www.hackthebox.com/machines/g...

--------
⏱️ Timestamps:
00:00 - Intro & Target Overview
04:39 - WordPress Enumeration with WPScan
06:14 - GiveWP CVE-2024-5932 RCE Exploitation
12:38 - Identifying Kubernetes Environment
21:32 - Setting up Ligolo-ng for Pivoting
32:20 - Adding Routes to K8s Network
33:36 - PHP-CGI CVE-2024-4577 Exploitation
57:55 - Interacting with K8s API via curl
1:19:56 - CVE-2024-21626 Container Escape Setup
--------

Follow me for more real-world hacking walkthroughs, live streams, and cert prep content 👇

💻 Labs
GitHub: https://github.com/strikoder

🎥 Streams & Short Content
Twitch:   / strikoder  
Instagram:   / strikoder  
TikTok:   / strikoder  

💬 Community & Discussions
Discord Server:   / discord  
X (Twitter): https://x.com/Strikoder

📨 Official Contact
LinkedIn:   / strikoder  
Email: [email protected]

More videos coming soon on PNPT, and OSCP prep.
Stay tuned, and thanks for the support!

#Giveback kubernetes #containerescape #runc #cve2024 #wordpress #ligolong #cloudpentesting #k8s #oscp #pt1 #hackthebox #tryhackme #portswigger #portswiggeracademy #activedirectory #linux #windows
#ethicalhacking #cybersecurity #pentesting #ctf #infosec #enumeration #privilegeescalation #windowshacking #networksecurity #bugbounty #RedTeam #capturetheflag #hackingtools #cyberseclabs #hackermindset #Nmap #terminal #strikoder