Detect Ivanti Sentry OS Command Injection Exploitation (CVE-2026-10520) in Splunk

#!/bin/bash
# LAB ENVIRONMENT ONLY - Simulates CVE-2026-10520 process chain
# Requires Java installed
cat > /tmp/sentry_sim_exploit.java << 'EOF'
import java.io.*;
public class sentry_sim_exploit {
    public static void main(String[] args) throws Exception {
        System.out.println("[SIM] Ivanti Sentry CVE-2026-10520 process chain simulation");
        ProcessBuilder pb = new ProcessBuilder("/bin/bash", "-c", "id; whoami; uname -a; cat /etc/passwd | head -3");
        pb.redirectErrorStream(true);
        Process p = pb.start();
        BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
        String line;
        while ((line = br.readLine()) != null) { System.out.println(line); }
        p.waitFor();
    }
}
EOF
javac /tmp/sentry_sim_exploit.java -d /tmp/
cd /tmp && java sentry_sim_exploit

rm -f /tmp/sentry_sim_exploit.java /tmp/sentry_sim_exploit.class

#!/bin/bash
# LAB ONLY - Reverse shell simulation for CVE-2026-10520 detection validation
# Start a loopback listener in background first
nc -l 127.0.0.1 9999 &
LISTENER_PID=$!
sleep 1

# Simulate the Java->bash->nc chain
cat > /tmp/sentry_revshell_sim.java << 'EOF'
import java.io.*;
public class sentry_revshell_sim {
    public static void main(String[] args) throws Exception {
        System.out.println("[SIM] Reverse shell simulation - loopback only");
        // Simulate injection: java spawns bash which spawns nc
        ProcessBuilder pb = new ProcessBuilder("/bin/bash", "-c",
            "echo '[CVE-2026-10520-SIM] reverse shell test' | nc 127.0.0.1 9999");
        pb.redirectErrorStream(true);
        Process p = pb.start();
        p.waitFor(5, java.util.concurrent.TimeUnit.SECONDS);
        System.out.println("[SIM] Reverse shell payload sent to loopback");
    }
}
EOF
javac /tmp/sentry_revshell_sim.java -d /tmp/
cd /tmp && java sentry_revshell_sim
kill $LISTENER_PID 2>/dev/null
echo "[DONE] Test complete - check EDR for java->bash->nc process chain"

rm -f /tmp/sentry_revshell_sim.java /tmp/sentry_revshell_sim.class; kill $(pgrep -f 'nc -l 127.0.0.1 9999') 2>/dev/null

#!/bin/bash
# LAB ONLY - Web shell drop simulation for CVE-2026-10520
# Creates a benign marker file (not functional) to simulate web shell drop
SIM_WEBAPPS_DIR="/tmp/sim_sentry_webapps"
mkdir -p "$SIM_WEBAPPS_DIR"

# Simulate java process creating a JSP file (represents attacker's injected command writing webshell)
cat > /tmp/sentry_webshell_sim.java << 'EOF'
import java.io.*;
import java.nio.file.*;
public class sentry_webshell_sim {
    public static void main(String[] args) throws Exception {
        String webappsPath = "/tmp/sim_sentry_webapps";
        System.out.println("[SIM] Simulating web shell drop via command injection");
        // Write a benign marker file with .jsp extension (non-functional)
        String shellMarker = "<!-- CVE-2026-10520-SIM: This file simulates web shell drop. NOT functional. -->";
        Files.writeString(Paths.get(webappsPath + "/cmd_sim_marker.jsp"), shellMarker);
        // Simulate attacker also checking /tmp for staging
        ProcessBuilder pb = new ProcessBuilder("/bin/bash", "-c",
            "ls -la /tmp/sim_sentry_webapps/ && echo '[SIM] Web shell staged'");
        pb.redirectErrorStream(true);
        Process p = pb.start();
        BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
        String line;
        while ((line = br.readLine()) != null) { System.out.println(line); }
    }
}
EOF
javac /tmp/sentry_webshell_sim.java -d /tmp/
cd /tmp && java sentry_webshell_sim
echo "[DONE] Check file creation telemetry for .jsp file created by java process"

rm -rf /tmp/sim_sentry_webapps /tmp/sentry_webshell_sim.java /tmp/sentry_webshell_sim.class

#!/bin/bash
# LAB ONLY - Credential staging simulation for CVE-2026-10520 post-exploitation
mkdir -p /tmp/sim_sentry_creds

# Create fake credential files that simulate what an attacker would target
echo 'SIMULATED_SENTRY_CONFIG_NOT_REAL' > /tmp/sim_sentry_creds/server.xml.bak
echo 'SIMULATED_KEYSTORE_NOT_REAL' > /tmp/sim_sentry_creds/keystore.jks.bak

# Simulate Java -> bash -> file staging chain
cat > /tmp/sentry_cred_stage_sim.java << 'EOF'
import java.io.*;
public class sentry_cred_stage_sim {
    public static void main(String[] args) throws Exception {
        System.out.println("[SIM] Credential staging simulation - CVE-2026-10520");
        String[] cmds = {
            "cat /tmp/sim_sentry_creds/server.xml.bak | base64 > /tmp/exfil_stage.b64",
            "wc -c /tmp/exfil_stage.b64",
            "echo '[SIM] Staging complete - attacker would curl/wget this to C2'"
        };
        for (String cmd : cmds) {
            ProcessBuilder pb = new ProcessBuilder("/bin/bash", "-c", cmd);
            pb.redirectErrorStream(true);
            Process p = pb.start();
            BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
            String line;
            while ((line = br.readLine()) != null) { System.out.println(line); }
            p.waitFor();
        }
    }
}
EOF
javac /tmp/sentry_cred_stage_sim.java -d /tmp/
cd /tmp && java sentry_cred_stage_sim

rm -rf /tmp/sim_sentry_creds /tmp/exfil_stage.b64 /tmp/sentry_cred_stage_sim.java /tmp/sentry_cred_stage_sim.class