HackTheBox - Haze

00:00 - Introduction 01:00 - Start of nmap 03:30 - Discovering splunk is version 9.2.1 from port 8089 and searching CVE Databases to find CVE-2024-36991 06:30 - Looking at how the File Disclosure works in CVE-2024-36991 09:50 - Extracting Splunk Secrets to get a username and password 15:00 - The user is denied the ability to list users in Active Directory, using RID Brute to get a user list 15:45 - Alternative way to bypass user list ACL by using AddComputer to add a computer which will let us query a list of users and run RustHound with Kerberos 23:50 - Examining what our users can do in Bloodhound 26:20 - Performing a password spray 28:30 - Listing GMSA Accounts with Get-ADServiceAccount, then using PowerSploit's Find-InterestingDomainACL 35:00 - Showing BloodyAD's Get Writable option then performing Write Owner, Add GenericAll, Adding ourself to group and using Certipy to get Shadow Credentials 44:00 - Going over the Splunk Backup, which contains the Admin Password for Splunk, using a grep regular expression to find password hashes 48:30 - Adding a Malicious App to splunk to send us a reverse shell 52:00 - Using GodPotato to exploit the SeImpersonate Privilege and getting administrator