https://lukaszpastuszak.dev/tags/mssql-linked-servers/Recent content in Mssql-Linked-Servers on Łukasz Pastuszak - security notesHugoen-usSat, 13 Jul 2024 00:00:00 +0000https://lukaszpastuszak.dev/writeups/ghost/Sat, 13 Jul 2024 00:00:00 +0000https://lukaszpastuszak.dev/writeups/ghost/Ghost chains an LDAP injection and blind secret brute force into Gitea source access, a Ghost CMS file read for the DEV_INTRANET_KEY, and command injection in the intranet API for a container shell, then pivots through an SSH ControlMaster session, ADIDNS poisoning with NetNTLMv2 cracking, a gMSA password read, a Golden SAML attack, MSSQL linked-server impersonation, SeImpersonate, and intra-forest trust abuse to reach Administrator on the parent domain controller.