Adfs

TL;DR - A long one. A boolean LDAP injection on the intranet lets me log in as kathryn.holland with */*, then brute-force the password of gitea_temp_principal. Inside Gitea the Ghost CMS repo has a path traversal that reads /proc/self/environ for the DEV_INTRANET_KEY, and the dev API behind that key has a command injection, which gives me a shell in a Linux container running as root. Its env leaks intranet_principal, a real domain account. From there it is all AD: kerberoast adfs_gmsa, grab a cached Kerberos ticket for florence.ramirez, coerce justin.bradley with a fake DNS record plus Responder and crack his hash (user.txt). justin can read the adfs_gmsa gMSA password, so I forge a Golden SAML to log into the ADFS-protected MSSQL console, pivot through a linked server to PRIMARY, impersonate sa for RCE, abuse SeImpersonate to get SYSTEM on corp.ghost.htb, and finally forge a cross-domain Golden Ticket to own ghost.htb and grab root.txt. ...