Ctrlk
📜 Medium🛒 My Shop👾 Github📩 Telegram 📺 YouTube✖ Twitter
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Splunkd - Port 8089

Basic info

What is Splunk?

Splunk is a data platform that enables organizations to:

  • Search and investigate machine data in real-time

  • Monitor and alert on operational metrics and security events

  • Analyze and visualize data through dashboards

  • Correlate events across disparate data sources

  • Generate reports for compliance and business intelligence

Splunk Architecture

Splunk Components

1. Splunk Universal Forwarder

  • Lightweight agent installed on endpoints

  • Collects and forwards logs to indexers

  • Runs on Windows, Linux, macOS, Unix

2. Splunk Indexer

  • Receives and indexes data

  • Stores data in searchable format

  • Manages data retention

3. Splunk Search Head

  • Provides search capabilities

  • Hosts web interface

  • Runs searches across indexers

4. Splunkd (Management Service)

  • Core daemon/service

  • Handles API requests

  • Manages authentication

  • Executes scripts and apps

Splunk Deployment Models

Standalone Instance:

Distributed Deployment:

Default Ports

Port 8089 - Splunkd Management Port (Primary Target)

  • REST API endpoint

  • Administrative interface

  • Authentication required

  • SSL/TLS by default

Port 8000 - Splunk Web Interface

  • User-facing web UI

  • HTTP/HTTPS

  • Dashboard and search interface

Port 9997 - Splunk Forwarder

  • Data receiving port

  • Forwarder to Indexer communication

Port 8191 - Key-Value Store

  • Optional component

  • Distributed configuration

Reconnaissance & Enumeration

Port Scanning

Basic Nmap Scan

Sample Output:

Service Fingerprinting

Version Detection via HTTP

Via Splunk CLI (if installed locally)

SSL Certificate Analysis

Shodan Queries

Find exposed Splunk instances:

Web Interface Enumeration

Access Splunk Web UI

Check for Free/Enterprise Version

Vulnerability Analysis

1. Free Version - No Authentication

Issue: Splunk Free version (converted from trial after 60 days) may lack authentication

Detection:

Exploitation:

2. Default Credentials

Common Default Credentials:

Testing Default Credentials

3. Credential Brute Force

Using Hydra

Using Metasploit

Custom Python Script

Remote Code Execution (RCE)

Method 1: Custom Splunk App with Scripted Inputs

Concept: Splunk apps can contain scripted inputs (Python, Bash, PowerShell, Batch) that execute automatically

Step-by-Step Exploitation:

1. Create Malicious App Structure

2. Create Reverse Shell Script

For Linux (Python):

For Linux (Bash):

For Windows (PowerShell):

For Windows (Batch):

3. Create inputs.conf

4. Create app.conf

5. Package the App

6. Deploy the App

7. Get Shell

Method 2: Using Pre-Made Exploit

Using reverse_shell_splunk Tool

Method 3: Splunk Search Command Injection

Via Search Processing Language (SPL)

Method 4: REST API Command Execution

Via server/control/restart endpoint (with proper permissions)

Method 5: Metasploit Modules

Using Metasploit for RCE

Data Exfiltration

Search Sensitive Data

Via Web UI Search:

Via REST API:

Export Data

Export Search Results:

Dump Entire Index:

List and Download Apps

Enumerate Installed Apps:

Download App Packages:

Privilege Escalation

Local Privilege Escalation (Linux)

Splunk runs as root by default on Linux!

Method 1: Malicious App with SUID Binary

Method 2: Splunk Forwarder Privilege Escalation

Method 3: Cron Job Manipulation

Windows Privilege Escalation

Method 1: Service Manipulation

Method 2: DLL Hijacking

Persistence

Backdoor User Creation

Persistent App Backdoor

Scheduled Search Backdoor

Post-Exploitation

Credential Extraction

From passwd File:

From splunk.secret:

From App Configurations:

Lateral Movement

Use Splunk as Pivot:

Extract Network Topology:

Defense & Hardening

Secure Installation

Initial Setup:

Disable Free License Features:

Authentication & Access Control

Enable Strong Authentication:

Multi-Factor Authentication:

Role-Based Access Control (RBAC):

Network Security

Firewall Rules:

Use TLS/SSL:

Reverse Proxy:

Monitoring & Detection

Enable Audit Logging:

Monitor for RCE Attempts:

Intrusion Detection Rules:

Regular Security Audits

Update & Patch

Tools & Scripts

Essential Tools

  1. Splunk CLI - Official command-line interface

  2. curl - REST API interaction

  3. Metasploit - Exploitation framework

  4. nmap - Port scanning

  5. SplunkWhisperer - Automated exploitation tool

SplunkWhisperer (Automated Exploitation)

Custom Enumeration Script

Cheat Sheet

Quick Reference

Important Files

Common Endpoints

Conclusion

Splunk, while being a powerful security monitoring tool, can ironically become a critical security vulnerability when misconfigured. The combination of extensive data access, code execution capabilities, and privilege levels makes compromised Splunk instances extremely valuable to attackers.

Key Takeaways:

  1. Never use default credentials - Change admin:changeme immediately

  2. Enable strong authentication - Use MFA and LDAP/AD integration

  3. Restrict network access - Bind to localhost or use firewall rules

  4. Monitor app installations - Review and approve all apps

  5. Enable audit logging - Track all administrative actions

  6. Run with least privilege - Don't run Splunk as root/SYSTEM

  7. Regular security audits - Review users, roles, and apps

  8. Keep updated - Apply security patches promptly

  9. Secure the API - Require SSL/TLS for all connections

  10. Defense in depth - Multiple security layers

Attack Vectors:

  • Default credentials (admin:changeme)

  • Weak passwords

  • Unauthenticated free version

  • Malicious app deployment (RCE)

  • Scripted inputs (code execution)

  • Local privilege escalation (root/SYSTEM)

  • Data exfiltration (sensitive logs)

  • Credential harvesting

Remember to only perform these techniques during authorized security assessments. Unauthorized access is illegal and unethical.

Additional Resources

Learn & practice For the Bug Bounty

Support VeryLazyTech 🎉
PreviousInfluxDB - Port 8086NextBitcoin - Port 8333, 18333, 38333, 18444

Last updated