[not_a_30t]

https://app.hackthebox.com/machines/616
All the Best for pwning HTB Ghost an Insane Machine

[chewablechunk01]

subdomain found: https://federation.ghost.htb/

[a44857437]

There is a Ghost CMS on port 8008 (http://ghost.htb:8008/)

[timizart]

subdomain found: https://federation.ghost.htb/

I think it's a False positive

Login form at http://intranet.ghost.htb:8008/login

[BahsbFAISfjhb]

https://intranet.ghost.htb:8443/login which has a link to https://intranet.ghost.htb:8443/api/login which is an ADFS login page

---

https://intranet.ghost.htb:8443/login which has a link to https://intranet.ghost.htb:8443/api/login

Also has a TM for © 2018 Microsoft, might be something vulnerable here, can't find any relevant CVEs though

[Pie17]

Guys anyone solved the challenge or progressed any bit???

[slukl]

Guys anyone solved the challenge or progressed any bit???

There are two other thread

Discussion: https://breachforums.sb/Thread-Ghost-Insane

Easy(solution) sounds like with evil-winrm connection commands https://breachforums.sb/Thread-Ghost-Ins...y-solution

[v33]

is there a way for bruteforcing the ldap password without using that script?

[xiaomi_1199]

subdomain found: https://federation.ghost.htb/

I think it's a False positive

Login form at http://intranet.ghost.htb:8008/login

 which tool help's you to find this sub-domain

[shadow0exe13]

anyone knows the hash admin can he drop it