Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update modules to use splunk library #18927

Open
1 of 6 tasks
errorxyz opened this issue Mar 6, 2024 · 2 comments
Open
1 of 6 tasks

Update modules to use splunk library #18927

errorxyz opened this issue Mar 6, 2024 · 2 comments
Labels
suggestion-feature New feature suggestions

Comments

@errorxyz
Copy link
Contributor

errorxyz commented Mar 6, 2024

Summary

Now that #18715 is landed, we need to update the splunk modules to use this library

  • modules/exploits/multi/http/splunk_upload_app_exec.rb
  • modules/exploits/multi/http/splunk_privilege_escalation_cve_2023_32707.rb
  • modules/exploits/multi/http/splunk_mappy_exec.rb
  • modules/exploits/unix/http/splunk_xslt_authenticated_rce.rb
  • modules/auxiliary/scanner/http/splunk_web_login.rb
  • modules/auxiliary/gather/splunk_raw_server_info.rb
@errorxyz errorxyz added the suggestion-feature New feature suggestions label Mar 6, 2024
@nrathaus
Copy link
Contributor

nrathaus commented Apr 22, 2024

Easiest way to get a splunk copy running:
docker run -d -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=splunk" --name splunk splunk/splunk:7.1.0

Change 7.1.0 to older/newer versions depending on your needs

NOTE: Some versions don't support SPLUNK_PASSWORD and will not start without intervention

@nrathaus
Copy link
Contributor

Unfortunately with docker version, and Free Trial, the login process is "disabled" - making it not a good unit-test for the Ruby modifications

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
suggestion-feature New feature suggestions
Projects
None yet
Development

No branches or pull requests

2 participants