Uploaded February 2026 | Updated September 2026, 2 weeks ago
00:00 - Introduction
01:00 - Start of nmap
03:20 - Adding the API Key to our WPScan
08:00 - Discovering a POC for the GiveWP plugin and getting a shell
12:00 - Looking at the WP Database, not getting much information
18:00 - Discovering an HTTP endpoint in the environment variable, setting up chisel to look at it
22:00 - Looking at the custom web page, it is vulnerable to a PGP CGI Vulnerability
30:00 - Shell on the second pod
31:00 - Discovering a Kubernetes (k8s) token, copying it back to our box and setting up kubectl to examine Kubernetes and dumping secrets
39:50 - Showing we didn't need KubeCTL we could have used curl, showing hacktricks age that has some nice tips on setting this up to easily query the k8s api
44:50 - With a password from k8s, we can login to the box and execute a runc wrapper with sudo. It is running version 1.1.11 which is vulnerable to an sandbox escape.
52:15 - Showing an alternative way to exploit this binary through exploiting the wrapper with a simple path traversal in mounts
00:00 - Introduction
01:00 - Start of nmap
03:20 - Adding the API Key to our WPScan
08:00 - Discovering a POC for the GiveWP plugin and getting a shell
12:00 - Looking at the WP Database, not getting much information
18:00 - Discovering an HTTP endpoint in the environment variable, setting up chisel to look at it
22:00 - Looking at the custom web page, it is vulnerable to a PGP CGI Vulnerability
30:00 - Shell on the second pod
31:00 - Discovering a Kubernetes (k8s) token, copying it back to our box and setting up kubectl to examine Kubernetes and dumping secrets
39:50 - Showing we didn't need KubeCTL we could have used curl, showing hacktricks age that has some nice tips on setting this up to easily query the k8s api
44:50 - With a password from k8s, we can login to the box and execute a runc wrapper with sudo. It is running version 1.1.11 which is vulnerable to an sandbox escape.
52:15 - Showing an alternative way to exploit this binary through exploiting the wrapper with a simple path traversal in mounts
