Splunk — Discovery & Enumeration
Background
Splunk is a log analytics and data visualization platform often deployed as a SIEM. It is prevalent in large enterprise environments and frequently runs as root (Linux) or SYSTEM (Windows), making compromise highly impactful. Splunk has historically been free of many exploitable vulnerabilities — the primary attack surface is weak or null authentication, since admin access enables deploying custom applications that provide RCE.
Key stats:
- Founded 2003; IPO on NASDAQ (SPLK) in 2012
- 7,500+ employees; ~$2.4B annual revenue; Fortune 1000 (2020)
- 92 Fortune 100 companies are clients
- 2,000+ apps on Splunkbase
- Notable CVEs: CVE-2018-11409 (info disclosure), CVE-2011-4642 (authenticated RCE — very old versions)
- 47 total CVEs at time of writing — most non-exploitable in practice
Discovery / Footprinting
Default ports
| Port | Service | Notes |
|---|---|---|
8000 | Splunk Web (HTTPS) | Main UI — login page |
8089 | Splunk Management / REST API (HTTPS) | Used for API communication and Splunk-to-Splunk comms |
8191 | KV store | Internal; less commonly exposed |
9997 | Splunk indexing port | Receives data from forwarders |
Nmap service detection
sudo nmap -sV 10.129.201.50
PORT STATE SERVICE VERSION
8000/tcp open ssl/http Splunkd httpd
8089/tcp open ssl/http Splunkd httpd
Nmap identifies both ports as Splunkd httpd. Seeing ports 8000 and 8089 open together is a reliable Splunk fingerprint.
Default credentials
| Version | Default credentials |
|---|---|
| Older Splunk Enterprise | admin:changeme (displayed on the login page) |
| Newer Splunk Enterprise | Set during installation — no universal default |
| Splunk Free | No authentication |
Always try common weak passwords if defaults fail: admin, Welcome, Welcome1, Password123, splunk.
Enumeration
Splunk Free — no authentication
The Splunk Enterprise trial converts to Splunk Free after 60 days. Splunk Free has:
- No user or role management
- No authentication required
- Full access to all Splunk functionality
This is frequently encountered when administrators install a trial to test Splunk and then forget about it. Organizations on a budget may also intentionally run the free version without understanding the security implications.
Signs you are on Splunk Free: The login page is bypassed entirely, or the license page shows “Free” under License Group.
What is accessible after login
Once authenticated (or on a Free instance):
| Feature | Attacker value |
|---|---|
| Search & Reporting | Query indexed data — may contain logs with credentials, tokens, internal IPs |
| Apps | Install/manage Splunk apps — malicious app = RCE |
| Settings → Data Inputs → Scripted Inputs | Define scripts that Splunk executes as SYSTEM/root — primary RCE vector |
| Splunkbase | Download and install apps (internet access required) |
| REST API (port 8089) | Programmatic access to all Splunk management functions |
Scripted inputs — RCE primitive
Scripted inputs are designed to pull data from external sources (APIs, file servers) by executing a script and feeding its STDOUT into Splunk as data. Since Splunk runs as root/SYSTEM and Python is bundled with every Splunk installation, this is a reliable RCE path:
- Linux: Bash or Python reverse shell
- Windows: PowerShell, Batch, or Python reverse shell
- Any platform: Python (always available)
This is covered in the Attacking Splunk section.
Data of interest in Splunk search
If data has already been indexed, searching it may yield sensitive information before going for RCE:
index=* sourcetype=* password OR credential OR secret OR api_key | head 100
index=* sourcetype=syslog | head 50
index=* source="*access.log*" | head 50
Look for:
- Credentials in log lines (database connection strings, API keys)
- Internal hostnames and IP ranges
- Service account activity
Enumeration checklist
- Identify Splunk on ports 8000 and 8089 via Nmap
-sV - Browse to
https://<target>:8000— note whether a login page appears or Splunk Free loads directly - Try default credentials:
admin:changeme - Try common weak passwords if defaults fail
- Check license type (Settings → Licensing) to confirm Free vs Enterprise
- Note Splunk version (visible in footer or
https://<target>:8089/services/server/info) - Check for installed apps that might expand attack surface
- Search indexed data for credentials/sensitive info if access is available
- Confirm Python is available (it always is — bundled with Splunk)