HackTheBox - Haze
Source: YouTube · IppSec · published Jun 28, 2025 · 57:44
This video covers a Hack the Box machine called "Haze," focusing on compromising a semi-hardened Active Directory environment 0:00-0:08. The attack chains a Splunk file disclosure vulnerability with AD misconfigurations to gain a foothold 0:08-0:18.
Key Takeaways:
• The initial foothold is achieved by exploiting an outdated Splunk instance using a file disclosure vulnerability to leak the configuration and retrieve a domain password 0:08-0:18.
• The compromised user lacks permission to list AD users, requiring alternative enumeration such as a password spray, RID brute force, or adding a computer to the domain since computers retain user listing privileges 0:18-0:35.
• After successfully executing a password spray, a user with WinRM access is unlocked, leading to a privilege escalation phase involving an attack path not immediately visible in BloodHound 0:35-0:41.
This machine highlights the critical risks of running outdated third-party software and the dangers of overly permissive default domain user privileges.
Sources:
- 0:00-0:08 Introduction to the Haze box and semi-hardened AD domain
- 0:08-0:18 Exploiting outdated Splunk for config disclosure and credentials
- 0:18-0:35 Working around user listing restrictions via password spray and domain computer additions
- 0:35-0:41 Unlocking WinRM access and discovering hidden BloodHound attack paths
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is IPSC and we'll be doing Haze from Hack the Box, which is a box I really enjoyed because it involves attacking a semi-h hardened Active Directory domain. But before we get to AD, we discover an outdated version of Splunk that's running and that is vulnerable to a file disclosure vulnerability, giving us the ability to leak the Splunk config and retrieve a password to get onto the domain. But the user we get access to doesn't have permission to list other users. And the next step is a password spray. So we can either perform a RID brute force to get a user list, but also domain users can add computers to the domain and computers are still allowed to list users. So once we perform the password spray, you unlock a user that has WinRM access. And the next step …