HTB Giveback

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/02/21/htb-giveback.html
• Blog Title: HTB: Giveback
• Suggested Section: Pentesting Web -> Deserialization -> PHP - Deserialization + Autoload Classes (add a subsection for GiveWP CVE-2024-5932 / unauthenticated POP-to-RCE pattern) and optionally cross-link from Pentesting Web -> Wordpress

🎯 Content Summary

Title / context
HackTheBox “Giveback” walkthrough. The demonstrated portion covers external recon → WordPress/GiveWP enumeration → exploiting CVE-2024-5932 for unauthenticated RCE → getting a shell inside a Kubernetes WordPress pod → extracting mounted secrets and service topology → MariaDB access → pivot-style internal HTTP enumeration using PHP because common tooling is missing. The blog intro mentions later pivoting to another pod, Kubernetes API interaction, SSH to h...

🔧 Technical Details

Unauthenticated PHP object injection → RCE in WordPress plugins (CVE-2024-5932 pattern): when a plugin deserializes attacker-controlled input (here, a form field like give_title during donation processing such as action=give_process_donation), an attacker can inject a crafted serialized object. If the application’s dependency graph provides a usable POP chain, the chain can pivot into a dangerous sink (example shown: setting a validator/callback field to shell_exec) and execute arbitrary commands. Because output may be blind, prefer callback payloads (e.g., bash reverse shell) and catch them with a listener like nc -lnvp PORT.

HTTP enumeration from stripped containers: if curl/wget/ping are missing in a container, use whatever runtime exists (PHP, Python, etc.) as a network client. Example: php -r "echo file_get_contents('http://IP:PORT/path');" to query intern...

🤖 Agent Actions

Updated PHP - Deserialization + Autoload Classes with a new GiveWP (<3.14.2) CVE-2024-5932 subsection detailing the unauthenticated PHP object injection chain in give_title, example POST workflow to give_process_donation, the POP components (StripeObject/Faker ValidGenerator → shell_exec), and blind RCE execution tips. Added exploitation notes and references to the blog and PoC repository.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/02/21/htb-giveback.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Deserialization -> PHP - Deserialization + Autoload Classes (add a subsection for GiveWP CVE-2024-5932 / unauthenticated POP-to-RCE pattern) and optionally cross-link from Pentesting Web -> Wordpress".

Repository Maintenance:

• MD Files Formatting: 948 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0