HackTheBox – Giveback Walkthrough | WordPress, Ligolo-ng, PHP-CGI, Kubernetes Escape скачать в хорошем качестве

HackTheBox – Giveback Walkthrough | WordPress, Ligolo-ng, PHP-CGI, Kubernetes Escape

In this HackTheBox machine, we exploit a WordPress GiveWP plugin vulnerability (CVE-2024-5932) for initial RCE, discover we're in a Kubernetes environment, pivot using Ligolo-ng to access internal services, exploit PHP-CGI argument injection (CVE-2024-4577) in a legacy intranet pod, enumerate Kubernetes API using service account tokens, and finally escape the container by exploiting runc CVE-2024-21626 to achieve root access on the host. This machine covers cloud-native security, container breakouts, and advanced pivoting techniques. If you're learning Kubernetes security, cloud pentesting, OSCP, or just love seeing machines get popped... this one's for you. 📂 Scripts and Commands: https://github.com/strikoder/CTFS/blo... 🏠 Room Link: https://www.hackthebox.com/machines/g... -------- ⏱️ Timestamps: 00:00 - Intro & Target Overview 04:39 - WordPress Enumeration with WPScan 06:14 - GiveWP CVE-2024-5932 RCE Exploitation 12:38 - Identifying Kubernetes Environment 21:32 - Setting up Ligolo-ng for Pivoting 32:20 - Adding Routes to K8s Network 33:36 - PHP-CGI CVE-2024-4577 Exploitation 57:55 - Interacting with K8s API via curl 1:19:56 - CVE-2024-21626 Container Escape Setup -------- Follow me for more real-world hacking walkthroughs, live streams, and cert prep content 👇 💻 Labs GitHub: https://github.com/strikoder 🎥 Streams & Short Content Twitch:   / strikoder   Instagram:   / strikoder   TikTok:   / strikoder   💬 Community & Discussions Discord Server:   / discord   X (Twitter): https://x.com/Strikoder 📨 Official Contact LinkedIn:   / strikoder   Email: strikoder@gmail.com More videos coming soon on PNPT, and OSCP prep. Stay tuned, and thanks for the support! #Giveback kubernetes #containerescape #runc #cve2024 #wordpress #ligolong #cloudpentesting #k8s #oscp #pt1 #hackthebox #tryhackme #portswigger #portswiggeracademy #activedirectory #linux #windows #ethicalhacking #cybersecurity #pentesting #ctf #infosec #enumeration #privilegeescalation #windowshacking #networksecurity #bugbounty #RedTeam #capturetheflag #hackingtools #cyberseclabs #hackermindset #Nmap #terminal #strikoder