Splunk Universal Forwarder (RCE)

Splunk is a log-analytics platform common in corporate environments. Its juiciest attack surface is not a code vulnerability but a by-design feature: Splunk lets you deploy custom applications that run scripts (Python, PowerShell, Batch, or Bash) on a schedule. If we manage to upload our own app (with administrator credentials, often the factory admin:changeme), we get command execution on the server and, through the Universal Forwarder, on every endpoint that has the agent installed. That turns a compromised Splunk into a mass-deployment vector.

Mechanism

A Splunk app is simply a folder structure of bin/ (the scripts) and default/ (the inputs.conf file, which tells Splunk what to run and how often). You place the reverse shell in bin/ and declare it as a scripted input:

[script://./bin/rev.py]
disabled = 0
interval = 10
sourcetype = shell

You package it all into a tarball with the .spl extension and upload it from Manage Apps -> Install app from file:

tar -cvzf updater.tar.gz splunk_shell/

As soon as Splunk installs the app, the scripted input runs the script every interval seconds and returns the shell to your listener. Since the target is often Windows, the usual payload is a .bat that launches a PowerShell one-liner with -w hidden.

Requirements

You need authenticated access to the management interface (default port 8000) with permission to install applications, which almost always means the administrator role. Unchanged default credentials are the most common way in. The Universal Forwarder listens on 8089 and, if the deployment server is compromised, lets you push the malicious app to every agent at once.

How to detect it

The main indicator is a new application appearing under $SPLUNK_HOME/etc/apps that contains scripted inputs, especially if the script is a reverse shell or calls powershell/cmd. At the process level, seeing splunkd spawn command interpreters gives it away, and at the network level, outbound connections from the Splunk host to an external IP at regular intervals (the input's interval).

Defence. Change the default credentials, restrict who can install applications, run Splunk and its forwarders under least-privilege accounts, network-segment the deployment server, and periodically review installed apps and their inputs.conf. Related to command injection, Jenkins RCE and credential reuse.