what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-77695

Splunk Search Remote Code Execution

Posted Dec 23, 2011

Authored by Gary O'Leary-Steele, juan vazquez | Site metasploit.com

This Metasploit module abuses a command execution vulnerability within the web based interface of Splunk 4.2 to 4.2.4. The vulnerability exists within the 'mappy' search command which allows to run python code. To exploit this vulnerability a valid Splunk user with the admin role is required. Unfortunately, Splunk uses a default credential of 'admin:changeme' for admin access, which is used to leverage our attack. The Splunk Web interface runs as SYSTEM on Windows and as root on Linux by default.

tags | exploit, web, root, python

systems | linux, windows

advisories | CVE-2011-4642, OSVDB-77695

SHA-256 | 4cec15e9c8252677e5cd1bb453f1bd43e0c2eb409d8162a5ce458bb290116509

Download | Favorite | View