Compromise Splunk for AWS Privilege Escalation

Learn how to leverage defensive infrastructure to achieve our objectives in this intermediate lab. Get hands on with creating a malicious Splunk add-in, take control of the underlying OS and increase AWS access!

Starting a new red team engagement, you have been given the login for a relatively unprivileged SOC account. Can you leverage defensive infrastructure and AWS services to access sensitive data and help you achieve your objectives?

• Basic Linux command line knowledge
• Basic Python knowledge
• Basic AWS knowledge

• Create a malicious Splunk add-in
• Get a stable shell on a Splunk server
• Identify and descrypt stored secrets
• Enumerate AWS IAM and EC2

Splunk is a very popular and widely used SIEM, that allows defenders to detect malicious activity in their environment. However, without proper protection, Splunk can also be leveraged by threat actors to compromise the application, underlying operating system, and potentially on-premises or cloud environments.

The free version of Splunk is uncredentialed, and on accessing the page we see the web headers Server: Splunkd and Set-Cookie: splunkweb_uid are set.