HTB GhostLink Complete Writeup: MQTT Healthcheck NTLM Relay, Gogs CVE-2025-8110 and ESC11 ADCS Domain Compromise
GhostLink is a HackTheBox Hard Windows machine pairing an Active Directory Domain Controller with two internal application servers hiding behind a reverse proxy. The chain starts with an unauthenticated MQTT broker whose node healthcheck topic can be poisoned to force the svc_canary service account into an NTLM relay, yielding an authenticated session on an internal secure file sharing application. A double URL encoded path traversal there exposes svc_canary's ntuser.dat, whose RecentDocs artifact reconstructs the path to a KeePass database holding Gogs credentials. The internal Gogs 0.13.3 instance falls to CVE-2025-8110 symlink based RCE for a shell as git on the toolkits host, and the exfiltrated gogs.db hands over a PBKDF2 hash that cracks in under a minute against a password-policy trimmed wordlist, becoming nvirelli and user.txt. Reaching root.txt requires pivoting a chisel SOCKS tunnel into the internal 172.16.20.0/24 network, then abusing ESC11: coercing the DC01$ machine account and relaying it to the certificate authority's unencrypted ICPR RPC interface to mint a DomainController certificate, finishing with a DCSync and a pass-the-hash WinRM session as Administrator.
Aug 10, 2026