HackTheBox - Haze

Name: HackTheBox - Haze
Uploaded: 2025-06-28T15:00:07Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:30 - Discovering splunk is version 9.2.1 from port 8089 and searching CVE Databases to find CVE-2024-36991...

IppSec · Beginner ·🔐 Cybersecurity ·9mo ago

00:00 - Introduction 01:00 - Start of nmap 03:30 - Discovering splunk is version 9.2.1 from port 8089 and searching CVE Databases to find CVE-2024-36991 06:30 - Looking at how the File Disclosure works in CVE-2024-36991 09:50 - Extracting Splunk Secrets to get a username and password 15:00 - The user is denied the ability to list users in Active Directory, using RID Brute to get a user list 15:45 - Alternative way to bypass user list ACL by using AddComputer to add a computer which will let us query a list of users and run RustHound with Kerberos 23:50 - Examining what our users can do in Bloo…

Watch on YouTube ↗ (saves to browser)

Chapters (14)

Introduction

1:00 Start of nmap

3:30 Discovering splunk is version 9.2.1 from port 8089 and searching CVE Databases

6:30 Looking at how the File Disclosure works in CVE-2024-36991

9:50 Extracting Splunk Secrets to get a username and password

15:00 The user is denied the ability to list users in Active Directory, using RID Br

15:45 Alternative way to bypass user list ACL by using AddComputer to add a computer

23:50 Examining what our users can do in Bloodhound

26:20 Performing a password spray

28:30 Listing GMSA Accounts with Get-ADServiceAccount, then using PowerSploit's Find

35:00 Showing BloodyAD's Get Writable option then performing Write Owner, Add Generi

44:00 Going over the Splunk Backup, which contains the Admin Password for Splunk, us

48:30 Adding a Malicious App to splunk to send us a reverse shell

52:00 Using GodPotato to exploit the SeImpersonate Privilege and getting administrat

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →