Skip to main content
CPEBuddy
HackTheBox - BigBang

HackTheBox - BigBang

Source: YouTube · IppSec · published May 3, 2025 · 1:01:08

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

This video demonstrates a penetration test on the Hack The Box machine "Big Bang," highlighting a novel Remote Code Execution (RCE) vulnerability in PHP's file_get_contents function 0:00.

Key Takeaways:
• The foothold relies on a file disclosure vulnerability within a WordPress plugin, exploiting file_get_contents in PHP 0:12.
• The specific PHP version (8.3.2) is vulnerable to a buffer overflow, which the author exploits to gain initial access 0:32.
• The author utilizes a modified proof-of-concept exploit script to trigger the buffer overflow and obtain a shell 0:36.
• This technique offers a unique alternative to traditional PHP RCE methods like uploading a Phar archive 0:20.

The video serves as a practical example of leveraging obscure PHP vulnerabilities for initial access in CTF environments.

Sources:

  • 0:00 Introduction to the Big Bang Hack The Box machine.
  • 0:12 Explanation of the file disclosure vulnerability in WordPress.
  • 0:32 Identification of the PHP buffer overflow vulnerability.
  • 0:36 Description of the exploit script usage.
  • 0:20 Comparison with Phar archive upload techniques.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is IPSC and we'll be doing Big Bang from Hack the Box which has one of my favorite footholds in a while. Because before doing this box, I had no idea that file get contents in PHP could lead to remote code execution. And the foothold starts with just that. It's a file disclosure vulnerability and a WordPress plugin. And the plug-in author showed it's possible to get rce on PHP versions before 8 via uploading a far archive, which honestly I've never done, so I'm not exactly positive how that one works. But it doesn't matter because for this box we're running uh PHP version 832 which is vulnerable to a buffer overflow. So we'll fix up the proof of concept exploit script which will perform the buffer overflow on filegate contents call with the np to get a shell a…