Skip to content

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Julien Voisin <[email protected]>
  • Loading branch information
jheysel-r7 and jvoisin authored Dec 27, 2023
1 parent 54df3d2 commit f950711
Showing 1 changed file with 8 additions and 11 deletions.
19 changes: 8 additions & 11 deletions modules/auxiliary/gather/splunk_raw_server_info.rb
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ def initialize(info = {})
],
'DisclosureDate' => '2018-06-08',
'Notes' => {
'Stability' => [],
'Stability' => [CRASH_SAFE],
'Reliability' => [],
'SideEffects' => [IOC_IN_LOGS]
}
Expand Down Expand Up @@ -57,7 +57,7 @@ def authenticate
fail_with(Failure::Unreachable, 'No response received for authentication request')
end

cval_value = res.get_cookies.match(/cval=([^;]*)/)[1]
cval_value = res.get_cookies.match(/cval=([^;]+)/)[1]

unless cval_value
fail_with(Failure::UnexpectedReply, 'Failed to retrieve the cval cookie for authentication')
Expand All @@ -73,7 +73,7 @@ def authenticate
res = send_request_cgi({
'method' => 'POST',
'uri' => login_url,
'cookie' => res.get_cookies,
'keep_cookies' => true,
'vars_post' => auth_payload
})

Expand All @@ -82,12 +82,12 @@ def authenticate
end

print_good('Successfully authenticated on the Splunk instance')
res.get_cookies
end

def get_contents(cookie = nil)
def get_contents
request = {
'uri' => normalize_uri(target_uri.path, 'en-US', 'splunkd', '__raw', 'services', 'server', 'info', 'server-info'),
'keep_cookies' => true,
'vars_get' => {
'output_mode' => 'json'
}
Expand All @@ -107,14 +107,11 @@ def run
# if we hit 6.6.0 - 7.1.0 we need to auth first
if res.body == '{"messages":[{"type":"ERROR","text":"See Other"}]}'
print_status('Authentication required, logging in and re-attempting')
res = get_contents(authenticate)
authenticate
res = get_contents
end

begin
j = JSON.parse(res.body)
rescue JSON::ParserError
fail_with(Failure::UnexpectedReply, 'Response not JSON parsable')
end
j = res.get_json_document

loot_path = store_loot('splunk.system.status', 'application/json', datastore['RHOST'], res.body, 'system_status.json')
print_good("Output saved to #{loot_path}")
Expand Down

0 comments on commit f950711

Please sign in to comment.