# Traitorware and Living Off the Land

Splunk Universal Forwarder app configs add a second outputs.conf route, silently shipping monitored files to an attacker-controlled rsyslog server.

- Payout: Research
- Severity: medium
- Program: Splunk Universal Forwarder
- Write-up by: Huntress
- Disclosed: 2023-04-11
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/traitorware-and-living-off-the-land-using-splunk-to-exfiltrate-data
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-traitorware-and-living-off-the-land-using-splunk-to-exfiltrate-data
- Tags: area:cloud domain:infra impact:data-leak impact:internal-access kind:research platform:threat-intel sev:medium tech:linux tech:windows technique:source-review vuln:misconfiguration

**Target:** Splunk Universal Forwarder config bundles (inputs.conf/outputs.conf)
**Root cause:** Splunk cascading configs let an app's local outputs.conf define a new [tcpout] route that takes precedence without overwriting the system route, so logs can be shipped to an additional receiver.
**Steps:**
1. Create a Splunk app under `<Splunk Install>\etc\apps\MaliciousAppName\local`
2. In `outputs.conf` define a new tcpout route to attacker rsyslog on port 514 with `sendCookedData=false`
3. In `inputs.conf` monitor a target directory/file and force routing to the syslog route only for that path
4. Deploy bundle manually or via Splunk Deployment Server
5. UF reads configs and ships monitored file contents to the rsyslog server
**How found:** Former Splunk admin noticed cascading config precedence and that adding new (not overwriting) outputs routes would avoid disrupting existing log streams, making tampering hard to notice.
**Exploitation:** Attacker with endpoint or deployment-server access pushes an app bundle; UF ships targeted files (e.g. secretpassword.txt) to attacker rsyslog while normal logs still flow to the real Splunk server, hiding exfil in UF log noise.
**Insight:** In cascading-config agents, adding a new named stanza (new tcpout route) rather than editing the existing one evades detection since existing log flow is unaffected; check for extra outputs/inputs stanzas in app dirs.

## Proof of concept (copied exactly from the original report)

**Malicious Splunk app outputs.conf exfil config**

```
outputs.conf

The above defines the output for the logs; in this instance, it's an Ubuntu server running rsyslog on port 514. The sendCookedData=false attribute disables the sending of Splunk's cooked data, which is metadata and additional information used by Splunk. This needs to be disabled when using a third-party receiver.
```

**inputs.conf monitoring secret file with syslog route**

```
inputs.conf

This file tells the Splunk UF the directory to monitor and forces the log routing to use the "syslog" route defined in outputs.conf, but only for this directory. The rest of the logs on the system will be sent to Splunk as expected, allowing us to monitor and absorb these files virtually undetected. In general, Splunk can ingest any file saved to disk using this method. For our use case, it's just monitoring a single txt file.
```