Official Ghost Discussion

HTB Content Machines
42

ok, thank you I will try that

43

Hii Froggie :frog:. Iā€™ve found 5, the main 2 domains in the different ports and 3 subdomains. The :man_with_probing_cane: :syringe: you need to do it mannualy or can do it with an automated tool?

44

You can use burp or even curl i think to find it. Im not great with that type of exploit at all and i still dont fully understand it someone had to hold my hand some with it. but will need automated to extract the goodies.

45

The hint is to read the code when you get to the instance. :wink:

1 Like
46
48

Anyone else making progress? I feel like Iā€™ve exhausted every avenue of approach. :face_with_head_bandage: :fearful:

49

Where you at. Ive gotten a foothold.

2 Likes
50

Iā€™m still runninā€™!

I think iā€™ve found a ghost admin page, but am unsure because I get 404, etc.

Iā€™ve tried looking for content API, custom endpoints, database files (which redirectā€¦a lot), Iā€™ve founf the sitemap.xml (however, more rabbit holes, I believe),
Iā€™ve followed up on the redirects, but - 404ā€¦
Tried accessing the Ghost API is failing, tried looking for hidden or bugged endpoints, exposedd config files, etc.

Iā€™m ded. I suppose you could sayā€¦Iā€™m a :ghost: :cry:

51

You need a :key: actually you need 2 :key:'s for foothold.

2 subdomains are needed for foothold.
Feel free to DM me for more detailed nudges.

3 Likes
52

Thou must, be :poop: 'n meā€¦I looked back through my notes and found the dayumm :key:ā€¦Jeezā€¦LEtā€™s see what happens.

1 Like
53

Where we at, boys!?

Been afk for a whileā€¦ Just starting the box now to check the perspective.

2 Likes
54

:ghost: BOO

Itā€™s nuts in hereā€¦Justā€¦effinā€™ nuts. If you need a little assistance (or at least what I can provide, ask away). Iā€™m still pullin intel at the moment.

1 Like
55

I found a shite ton of data, DNS, endpoints, one key, and still goinā€™ā€¦however, I gotta take a break. So itā€™s up to you diligent folk now.

ā€¦Kindaā€™ weird how SpIdErS and GhOsTs go ā€˜togetherā€™, ainā€™t it?!! :eyes:
Adios, for now.

3 Likes
56

BROTHERS
we are getting a good bottom spanking with this one. :ghost:

2 Likes
57

gobuster will very quickly get you to a login form ā†’ it is easily cracked. From there, you will get a lot of info about users and a few directions you could take.

Maybe look for the code source repository as the next step

1 Like
58

And to make sure you actually readdd the code!

1 Like
59

LETS GOOOO. :frog: :frog: :frog:

Im fried. This box was so frustrating. :ghost:

7 Likes
60

Good job!!!

1 Like
61

Thank you my dude :frog:

Seeing the number of pwns so far its clear the Unintended path is what people are doing. The box clearly guides you to the unintended path more than the intended path. I still donā€™t know how to access the high value target. The unintended path completely bypasses half the box and is so much easier to follow becuase all the permissions and stuff SCREAM do this method.

1 Like
62

AD exploiting or LOLBins!?