Skip to main content
CPEBuddy
HackTheBox - Ghost

HackTheBox - Ghost

Source: YouTube · IppSec · published Apr 5, 2025 · 2:23:45

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

BLUF: This video details the exploitation of the "Ghost" Hack The Box machine, progressing from LDAP injection to a Golden SAML attack via Active Directory Federation Services (ADFS) dumping 0:00.

Key Takeaways:
• The initial entry vector involves LDAP injection, which allows authentication bypass and password attribute filling to access a Git repository 0:10.
• The Git repository hosts two applications: one with a file disclosure vulnerability and another with a command injection flaw 0:16.
• Lateral movement is achieved by using the file disclosure to read an API key, which is then used to exploit the command injection and gain access to a Linux container 0:23.
• The final privilege escalation involves dumping ADFS credentials to perform a Golden SAML attack, granting full domain control 0:32.

The exploitation chain demonstrates the critical risk of chaining multiple low-severity vulnerabilities to achieve high-impact results in complex enterprise environments.

Sources:

  • 0:00 Introduction to the Ghost box and high-level attack path
  • 0:10 LDAP injection exploitation details
  • 0:16 Discovery of vulnerable applications in Git
  • 0:23 Using file disclosure to enable command injection
  • 0:32 ADFS dumping and Golden SAML attack execution

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 2 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is IPSC and we're doing ghost from hack the box which if you can't tell from the video link, this is an extremely large box with lots going on. It'll start off with LDAP injection with which lets us not only bypass authentication but also Xfill the password attribute which gets us into git t that hosts two applications. One has a file disclosure vulnerability and the other is a command injection vulnerability. But the command injection requires reading an API key. So we can use the file disclosure to read the API key, exploit the command injection and land in a Linux container. There's a handful more lateral movement steps, but that leads to dumping the Active Directory Federation services. So, we can perform a golden SL attack to trick a website into thinking…