Skip to main content
CPEBuddy
HackTheBox - GiveBack

HackTheBox - GiveBack

Source: YouTube · IppSec · published Feb 21, 2026 · 58:57

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

This video details a "Give Back" challenge from Hack the Box, demonstrating a complex attack path starting from a WordPress vulnerability to escaping a Kubernetes container for root access.

Key Takeaways:
• The initial entry point is a vulnerable version of the "Give" plugin in WordPress, which allows for Remote Code Execution (RCE) 0:07.
• Upon exploitation, the target is revealed to be a pod within a Kubernetes environment rather than a standard VM 0:14.
• The attacker identifies a second pod containing a PHP vulnerability, which is exploited to obtain a Kubernetes token 0:19.
• This token grants access to read secrets, facilitating password reuse to SSH into the next host 0:25.
• The final privilege escalation involves exploiting a vulnerable version of "run C" via sudo to escape the container and gain root 0:36.

The summary illustrates a realistic multi-stage penetration test scenario common in cloud-native security assessments.

Sources:

  • 0:07 Discovery of vulnerable WordPress plugin.
  • 0:14 Identification of Kubernetes pod environment.
  • 0:19 Exploitation of PHP vulnerability for token access.
  • 0:25 Use of token for password reuse and SSH access.
  • 0:36 Container escape via vulnerable 'run C' binary.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is IPSC and today we'll be doing give back from Hack the Box which has quite a few technologies at play. First, we discover WordPress is running a vulnerable version of the give plugin. So, we get rce onto the box and discover it's not a box at all. It's a pod in a Kubernetes environment. There isn't much here, but we discover another pod on the network which has a weird PHP vulnerability. And once we exploit it, we gain access to a Kubernetes token that gives us the ability to read secrets. And through password reuse, we can SSH onto the box. And as this user, we can use pseudo to execute a wrapper binary that just passes us to run C. And it's running a vulnerable version of run C. So we can use that CVE to escape the container and get root. But there's also …