Ghostlink — HackTheBox Machine Writeup

All 6 custom scripts developed for this machine are attached below. Click any script to launch the Interactive Code Explorer to inspect syntax-highlighted code, search with Ctrl+F, copy, or download the files directly.

We start with a full TCP port scan against 10.129.62.59.

The box is clearly a Domain Controller — it's running DNS, Kerberos, LDAP, SMB and WinRM. Two things jump out as non-default: port 1883/tcp (MQTT) and an IIS web server on port 80.

Browsing to the IIS server on port 80 gives nothing but a static "Ghost Protocol Zero" landing page — the box is themed around a fictional APT group.

The MQTT broker on 1883 allows anonymous access. We subscribe to every topic and dump the retained messages:

The broker is acting as a node-tracking / health-monitoring bus for the group's infrastructure. The interesting topics are:

This leaks three hosts that are not in DNS from the outside:

We add these to /etc/hosts (they're virtual-hosted behind the DC's IIS/ARR reverse proxy) and browse:

• ▹gpz-op26-secure → 401, requires NTLM authentication.
• ▹gpz-op26-toolkits → a Gogs instance (self-hosted Git service), anonymously reachable.

The secureshare health-check topic contains a url field that the secureshare host periodically fetches to confirm it's still alive. The clever bit: the topic is writable, so we can repoint that url at our own box. When the health-check worker performs its HTTP request, it authenticates with NTLM — and we can capture (or relay) that authentication.

We run Responder in parallel to see what comes back:

Within a minute, the worker fetches our URL and hands us an NTLMv2 hash:

We point ntlmrelayx at http://gpz-op26-secure.ghostlink.htb, republish the MQTT topic with our url, and the relay completes:

We're now authenticated to the file-share app as svc_canary.

The app is a Blazor/ASP.NET front-end with an upload endpoint (/api/upload) and a download endpoint (/api/download/<file>), as revealed by app.js.

The download endpoint takes a filename directly in the URL:

We suspect it resolves <file> against an upload directory on the internal host. If it naively joins the path, a ..\ traversal would escape. Let's test the escalation ladder.

Attempt 1 — raw traversal (blocked):

Attempt 2 — single URL-encoding (still blocked):

Attempt 3 — double URL-encoding (works):

::How (and why) the bug works

URL-encoding turns special bytes into %xx. The trick is in how many times the server decodes the path before using it:

1. ▹IIS decodes the incoming URL once before handing the path to the ASP.NET app.
2. ▹The app (or its routing/framework) decodes it a second time when it builds the file path.

So:

The filter only ever sees the once-decoded form. It looks for a literal ..\ and, finding %2e%2e instead, lets the request through. The second decode pass then silently converts it back into a real traversal. This is the classic "double-encoding" filter bypass.

Now authenticated as svc_canary, we can pull its ntuser.dat (the per-user registry hive that records what the account has been doing):

We inspect the hive's recently opened documents using our forensics inspector:

svc_canary recently opened db.zip. RecentDocs entries map to .lnk shortcuts in %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\, so we pull the shortcut to learn the file's full path:

Then we download the archive itself:

It's a KeePass vault protected by the key file (no master password). Opening it:

Two things matter:

1. ▹vroth still has a password — every other account was migrated to a "centralized password manager", but vroth was forgotten. vroth:mOo03jpsqx8JQYMBwvFP is our ticket into Gogs.
2. ▹The Recycle Bin contains a deleted entry with a passpol.pdf attachment — the Default Domain Policy report. It tells us the minimum password length is 20 characters, which we'll use to speed up hash-cracking later.

Gogs 0.13.3 is vulnerable to CVE-2025-8110, an authenticated remote-code-execution via a symbolic-link bypass in its PutContents API.

::The bug, simply

Gogs lets users commit symlinks into a repository (normal git behavior). It also exposes a PutContents API that writes file content outside the normal git flow. When CVE-2024-55947 was patched, the fix validated the path — but it forgot to validate where a symlink in that path points.

So the attack is:

1. ▹Create a repo and commit a symlink that points at .git/config.
2. ▹Use PutContents to write through that symlink — Gogs follows it and overwrites the repo's .git/config, which lives outside the intended working-tree directory.
3. ▹In the injected .git/config, we set core.sshCommand to our reverse-shell command. The next time Gogs runs a git operation over SSH, that command executes.

On our listener we get a shell as the git service account:

The Gogs host has a local user nvirelli. Gogs stores user password hashes (PBKDF2-SHA256) in its SQLite database gogs.db, so we exfiltrate it:

We pull nvirelli's hash out:

And convert it to hashcat format (PBKDF2-HMAC-SHA256 = mode 10900), where the salt is base64-encoded and the hex digest is base64-encoded:

We su to nvirelli and grab the user flag:

nvirelli is a domain account, and the network has an Active Directory Certificate Services (ADCS) CA. We pivot through the Gogs host with chisel (reverse SOCKS proxy) so we can reach the CA on the internal 172.16.20.10, then enumerate ADCS for vulnerabilities:

::What ESC11 means

The CA accepts certificate requests over RPC (ICPR). Because it does not enforce encryption on those requests, we can relay a machine account's NTLM authentication directly into a certificate request. The classic ESC8 needs HTTP web enrollment; ESC11 does the same thing over the raw RPC interface.

Our target is the Domain Controller machine account (DC01$), which is allowed to request a DomainController certificate — and that certificate can impersonate the DC.

The attack is a two-step relay:

1. ▹Coerce DC01$ to authenticate to us (using coercer with the MS-RPRN / MS-DFSNM methods).
2. ▹Relay that authentication to the CA's ICPR interface with ntlmrelayx, requesting a DomainController certificate.

We now hold a DomainController certificate for DC01$. We use it (via PKINIT) to obtain the DC machine account's NT hash, then run DCSync to dump the Administrator hash:

Finally, we pass the Administrator hash into WinRM and read the root flag:

• ▹Wiz Research — Gogs Zero-Day RCE (CVE-2025-8110)
• ▹CVE-2025-8110 — NVD / SentinelOne
• ▹Certipy — ADCS attack tool
• ▹SpecterOps — Certified Pre-Owned (ADCS attack taxonomy, ESC1-ESC8+)
• ▹Impacket — ntlmrelayx / secretsdump
• ▹Chisel — fast TCP/UDP tunnel