https://ctf-hallllow.blog/tags/ldap-injection/ Recent content in Ldap-Injection on hallllow Hugo en-us Tue, 03 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ghost/ Tue, 03 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ghost/ HTB Ghost (Insane). A long AD chain: a boolean LDAP injection on the intranet brute-forces gitea_temp_principal, Gitea leaks a Ghost CMS path traversal that reads env vars for an API key, the dev API has a command injection giving a shell in a Linux container, and its env leaks a domain account. From there kerberoasting, a cached Kerberos ticket, a DNS-coerced Responder capture, a Golden SAML via the adfs_gmsa account, a MSSQL linked server, SeImpersonate, and finally a cross-domain Golden Ticket to own the whole forest.