HTB: Haze
Haze is a challenging Active Directory machine characterized by a vulnerable Splunk installation and security configurations. The machine involves CVE-2024-36991, decrypting the Splunk secret, exploiting multiple ACL/ACE vulnerabilities, and abusing SeImpersonatePrivilege.
March 31, 202513 min read WindowsHardActive DirectorySplunkCVE-2024-36991Password SprayingWriteOwnerShadow CredentialsSeImpersonatePrivilegeGodPotato