log-slapper's Introduction

log-slapper 🪵🪓👹

Every company undoubtedly trusts its SIEM, right? Think twice.
We can inject fake logs, distract blueteams and hide our attacks thanks to the vulnerable SIEM solutions.

description

log-slapper is an offensive security tool designed to be used by red-teamers during the post-exploitation phase. It exploits vulnerable (any Splunk, basically) SIEM solutions and configurations that allow the injection of arbitrary logs into the target system.

log-slapper can:

mimic attacks on behalf of any other computer on the network
run in interactive mode: Target Shell Playzone
send logs from future and past (time travelling!)
perform HEC based attacks
perform built-in attacks like login success/fail login, new process creation events spam in windows
perform pre-determined attack scenarios using .yaml

installation

To install log-slapper, you can directly compile the project using the go build . command. If you encounter any errors, follow the steps below to ensure all dependencies are installed:

# clone the Repository:
git clone https://github.com/oz9un/logslapper.git
cd logslapper

# install Dependencies:
sudo apt install libnetfilter-queue-dev
sudo apt install libpcap-dev

# build the project:
go build .

usage

After the first installation, log-slapper needs to create a log.settings file, as it won't be created automatically. This file requires the following information:

Indexer/HF's IP Address: This is where the logs will be injected.
HEC Token: Optional, in case you have a HEC token of the target instance.

You can manually enter those details. However, if you have root access, you can start log-slapper with `sudo`, and it will automatically find the target Splunk instance's IP address:

sudo ./logslapper

After that, you can select the attack type you want from the interactive menu.

Besides the interactive menu, you can also select various attack types from the help menu and ran them directly:

other attack types are explained in the help menu, but if you need more details, you can examine the slides or contact me directly.

create your own attack scenarios to execute

log-slapper allows you to create custom attack scenarios, which can be collected in a single log file (using YAML format) and then provided as input to the tool. With this way, you can basically create any attack scenario in your mind and inject them into the target Splunk instance.

creating and executing a attack scenario

You can define your attack scenarios in a YAML file, where you can specify the logs, events, and sequences you want to simulate. Once your scenario is ready, save it as attack_template.yaml (or any name you prefer).

To execute log-slapper with your pre-determined attack scenario, use the following command:

./log-slapper attack -f attack_template.yaml

For the example attack_templates, have a look at the "example-attack-templates" folder.

using the event genie

There is also a custom chatgpt called "windows event genie", it's just created for to help you along creating windows attack scenarios. You can describe the attack you want to inject and it will create a .yaml for you:

Go to the Event Genie

about the research & tool

This tool has been showcased at several security conferences, including:

BsidesSATX
BsidesTirana
Hacktivity
BsidesPrague

The latest and most powerful version of log-slapper, along with the comprehensive research behind it, is being presented at DEFCON 32 Red Team Village by Özgün Kültekin. This version includes enhanced features and capabilities, making it a must-have tool for any red team operation.

Now, DEFCON32 slides are publicly available! : The SIEMless Hack: Rewriting Reality with Log Injection

changelog: diff between v2 and v1

As with the premiere in Red Team Village @DEFCON32, log-slapper now includes the following functionalities:

No Root Access Required: log-slapper no longer requires root access to inject logs, making it more versatile and easier to use in various environments.
Direct TCP Communication: Logs can be injected to target indexer/hf using direct TCP communication. You don't even have to have Splunk installed on the compromised machine.
Custom Attack Scenarios: Attackers can create their own attack scenarios and provide them as input to log-slapper. The tool can follow these pre-determined attack scenarios, allowing for more precise and controlled testing of SIEM solutions.

log-slapper's People

Contributors

Stargazers

Watchers

log-slapper's Issues

Missing events in 9.0.2

kindly note below defon yaml is not producing events with 9.0.2 Splunk, how to debug?

splunk:
  target_ip: "10.1.1.1"
  target_port: "9997"

log:
  index: "main"
  source: "/var/log/myapp.log"
  sourcetype: "my_custom_app"
  hostname: "defcon-test-32"

extra_fields:
  machine_id: "726329955b9a4fb99b9a64bd15999999"
  host_ip: "10.10.13.37"
  conference: "defcon"

events:
  - time: "03/03/2026 20:59:59"
    data: |
      03/03/2026 08:02:00 PM
      LogName=Security
      SourceName=Microsoft Windows security auditing.
      EventCode=4688
      EventType=0
      Type=Information
      ComputerName=DEFCON-TEST-COMP.com
      TaskCategory=Process Creation
      OpCode=Info
      RecordNumber=5853
      Keywords=Audit Success
      Message=A new process has been created.

      Creator Subject:
        Security ID:            -
        Account Name:           ozzyadmin
        Account Domain:         ozgun.com
        Logon ID:               0x9BB3354DA

      Target Subject:
        Security ID:
        Account Name:
        Account Domain:
        Logon ID:

      Process Information:
        New Process ID:         0x1e4
        New Process Name:       C:\Users\Public\Documents\mimikatz.exe
        Token Elevation Type:   %1936
        Mandatory Label:        Mandatory Label\High Mandatory Level
        Creator Process ID:     0x11f0
        Creator Process Name:   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        Process Command Line:   C:\Users\Public\Documents\mimikatz.exe --encrypt='all'
    
  # Example of a second event data entry
  - time: "03/03/2026 21:00:00"
    data: |
      03/03/2026 09:00:00 AM
      LogName=System
      SourceName=System Monitoring
      EventCode=5000
      EventType=1
      Type=Warning
      ComputerName=DEFCON-TEST-COMP.com
      TaskCategory=Application Crash
      OpCode=Warning
      RecordNumber=9001
      Keywords=Application Failure
      Message=An application has unexpectedly quit.

      Creator Subject:
        Security ID:            -
        Account Name:           ozzyadmin
        Account Domain:         ozgun.com
        Logon ID:               0x9BB5354DA

      Target Subject:
        Security ID:
        Account Name:
        Account Domain:
        Logon ID:

      Process Information:
        New Process ID:         0x1e4
        New Process Name:       C:\Users\Public\Documents\ozgun.exe
        Token Elevation Type:   %1936
        Mandatory Label:        Mandatory Label\High Mandatory Level
        Creator Process ID:     0x11f0
        Creator Process Name:   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        Process Command Line:   C:\Users\Public\Documents\ozgun.exe --decrypt='all'

no error
below is the container mounting the logslapper github repo

version: '3'

services:
  splunk-heavy-forwarder:
    #image: splunk/splunk:latest
    image: splunk/splunk:9.0.2
    container_name: splunk-heavy-forwarder
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=abc...

    ports:
      - "9997:9997"
    networks:
      - splunk-network

  splunk-web:
    image: splunk/splunk:9.0.2
    #image: splunk/splunk:latest
    container_name: splunk-web
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=abc...
    ports:
      - "8000:8000"
    networks:
      - splunk-network

  bash-container:
    image: debian:10
    container_name: bash-container
    command: ["bash", "-c", "while true; do echo '#'; sleep 10; done"]

    volumes:
      - /home/abc/src/splunk-test:/mnt/data
    networks:
      - splunk-network

networks:
  splunk-network:
    driver: bridge

images in follow up

Recommend Projects

oz9un / log-slapper Goto Github PK

log-slapper's Introduction

log-slapper 🪵🪓👹

description

installation

usage

create your own attack scenarios to execute

creating and executing a attack scenario

using the event genie

about the research & tool

changelog: diff between v2 and v1

log-slapper's People

Contributors

Stargazers

Watchers

Forkers

log-slapper's Issues

Missing events in 9.0.2

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent