CVE-2024-36985

This repository contains a functional Python exploit for CVE-2024-36985, targeting Splunk Enterprise via the 'copybuckets' custom search command to achieve remote code execution. The exploit authenticates to Splunk, constructs a malicious SPL query with a base64-encoded reverse shell payload, and triggers execution via the REST API.

This Metasploit module exploits CVE-2024-36985, an authenticated RCE vulnerability in Splunk Enterprise's splunk_archiver app. It leverages unsafe use of the | copybuckets lookup function to execute arbitrary commands via the sudobash helper script.