Splunk

Directory map

• Splunk — Discovery & Enumeration — ports, default creds, Splunk Free, scripted inputs, data of interest
• Attacking Splunk — scripted input RCE, app structure, PowerShell/Python reverse shells, deployment server pivot

Summary

Splunk is a log analytics platform commonly used as a SIEM in enterprise environments. It runs on port 8000 (web UI) and port 8089 (management/REST API), and typically runs as root or SYSTEM — making it a high-value target. Splunk has relatively few exploitable CVEs; the primary attack path is weak or null authentication leading to RCE via scripted inputs.

Discovery is straightforward: Nmap identifies both ports as Splunkd httpd. Default credentials on older versions are admin:changeme, visible on the login page. Newer installs set credentials during setup — try common weak passwords. The Splunk Enterprise 60-day trial converts automatically to Splunk Free, which has no authentication whatsoever; administrators who install trials and forget them leave a fully open Splunk instance on the network.

Enumeration focuses on two areas: what Splunk has already indexed (logs may contain credentials, API keys, internal network details — searchable via the UI) and the path to RCE via scripted inputs (Settings → Data Inputs → Scripted Inputs). Since Python is bundled with every Splunk installation and Splunk runs as root/SYSTEM, a scripted input running a Python reverse shell is a reliable and quick path to full system compromise.

Attacking Splunk via scripted inputs requires building a minimal app directory (bin/ + default/inputs.conf), placing the reverse shell in bin/, packaging it as a .tar.gz, and uploading it via Install app from file. On Windows, a .bat wrapper launches a PowerShell one-liner; on Linux, a Python script uses pty.spawn. The app enables automatically on upload and the scripted input fires within the configured interval (10 seconds). If the compromised instance is a deployment server, placing the app in $SPLUNK_HOME/etc/deployment-apps/ pushes RCE to every Universal Forwarder in the environment — Universal Forwarders lack Python, so use PowerShell (Windows) or Bash (Linux) for lateral movement payloads.