Official Ghost Discussion

HTB Content Machines
21

There are two websites, one of them is a login.

22

My box took awhile to load the second domain, although the port showed up on rust scan, just grab a drink and it should fix itself. I think the box takes time to ā€˜WAKEā€™ up

1 Like
23

I got some helpful info by using the API but not sure If itā€™s useful lmaooo. Iā€™m gonna take a step back sometimes that helps when your so tunneled on one thing.

1 Like
24

Iā€™m hitting walls left and right!
Maybe some SAML token manipulation or injection?

25

Anyone else having a lot of trouble with enum? Everything is so slow ): highest i have gotten on fuzzing is 20 requests a second ):

26

There is a very very specific way to get around this. Not sure what part youā€™re at but it is intended.

1 Like
27

Isnā€™t there an option to only allow X threads per second?

28

Im pretty sure its rate limited on purpose.

29

FYI If you do try to fuzz a certain something you can lock the box out and have to reset. Know from experience :slight_smile:

1 Like
30

There are three websites. But did you find the other login page in the subdomain? I think thats another rabbit hole. I also been trying to do enumeration but it keeps giving me an error waiting for headers with gobuster. I tried with the option -t for threads but with no luck.

31

Has anyone else tried some sort of SAML manipulation? Iā€™ve been beating this keyboard like it owes me money, and nothinā€™! Any leads?

32

Ngl thereā€™s more than three. :sob:

1 Like
33

How do you manage to do the enum because I see that its rate limiting and no matter if upscale the threads or increase the timeout, it keeps failing.

35

GOOD LORD. How many subdomains / logins this thing have :frog: HELP! Lol

4 Likes
36

Iā€™m getting a ton of redirection, failures, logins, etc.
I found some new XMLs but my eye holes canā€™t stay open!!

Welp, Iā€™m tappinā€™ out for now.
Good luck, if you drive forward! :sleeping_bed:t2: :zzz:

1 Like
37

Everyone being quiet on this box :slight_smile: Lol

Time to get back at it baby!

1 Like
38

Any hint? I have been enumerating and testing everything but 0% progress :smiling_face_with_tear:

39

Not sure on the true path but ive found a something with the aid of someone else related to a subdomain login.

it involves :man_with_probing_cane: :syringe:. It works but takes some good working knowledge of that exploit to get it.

40

You found more than 1 login page?

41

Yes Ive found 3. 1 is on a different port. the other 2 are on the normal one.

It takes awhile becuase the box is rate limited. But your FFUF should find them eventually just takes forever. You cant increase threads on your FFUF becuase it will cause errors and skips over some of the words. Anytime i tried to increase my rate it would error and time out. But if i run at the nomral 40 threads slowly it works consistently.

Theres 2 subdomains for sure ive found are required.