loanvitor / splunk-9.0.5---admin-account-take-over Goto Github PK

This script appears to be a Python exploit for a vulnerability in Splunk version 9.0.5, 8.2.11, and 8.1.14, identified by the CVE-2023-32707. The vulnerability allows a low-privileged user with the edit_user capability to escalate their privileges to that of the admin user by providing specially crafted web requests.

Here's a brief overview of the script:

Import Required Modules:

The script uses the argparse module to parse command-line arguments. It utilizes the requests module for making HTTP requests. It disables SSL warnings using urllib3 since it's interacting with the Splunk server over HTTPS. Command-Line Arguments:

The script expects several command-line arguments, including the Splunk host, username, password, target user, and an optional flag to force exploitation. HTTP Request to Splunk:

The script sends an HTTP GET request to the Splunk server to retrieve information about the specified user, including its capabilities. Version Check:

The script checks if the detected Splunk version is in the list of affected versions (9.0.4, 8.2.10, 8.1.13). If the version is affected or the force-exploit flag is set, it proceeds with the exploitation attempt. Capability Check:

It checks if the user has the 'edit_user' capability, making it exploitable. If exploitable, it generates a new random password and sends an HTTP POST request to change the password of the target user. Outcome:

The script prints messages indicating whether the target user was successfully taken over or if the account takeover failed.