Haze is a challenging Active Directory machine characterized by a vulnerable Splunk installation and security configurations. The machine involves CVE-2024-36991, decrypting the Splunk secret, exploiting multiple ACL/ACE vulnerabilities, and abusing SeImpersonatePrivilege.

404Gh0stMarch 31, 202513 min read

• Windows
• Hard
• Active Directory
• Splunk
• CVE-2024-36991
• Password Spraying
• WriteOwner
• Shadow Credentials
• SeImpersonatePrivilege
• GodPotato