# Ghost Network (CTF challenge)

> The only thing you can reach is an edge link-preview service that fetches a URL server-side. Everything else — cloud metadata and a mesh of internal *.ghost.local services — is on a network you can't…

Canonical: https://codelivly.com/ctf/challenges/ghost-network

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Insane |
| Points | 9000 |
| Estimated time | 2 h |
| Type | Live instance |
| Solves | 17 |
| Author | Codelivly |

The only thing you can reach is an edge link-preview service that fetches a URL server-side. Everything else — cloud metadata and a mesh of internal *.ghost.local services — is on a network you can't route to directly. Abuse the fetcher (SSRF) to pivot hop by hop: metadata → internal API → vault → domain controller. Each hop hands you the token for the next. Four tokens, one per hop. Your own isolated instance; the tokens are unique to you. Submit each CLV{...}; capture all four to complete.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)