HTB - Haystack
Getting Root:
Start with nmap and discovered port 22, 80, 9200
On port 80 we get a an image with base64 encoded talking about key
On port 9200 we use elastic search to find credentials to ssh to the box and user flag
To escalate privileges, we use CVE-2018-17246 to get user kibana who has access to logstash which is running as root
Create a file based on the logstash configuration files and get a reverse shell as root
Nmap
Enumeration
Checking Port 80
Checking the image
Google Translate
Gobuster on port 80 did not returned anything. I also tried with different User Agent
Checking port 9200
Gobuster
Research on Elasticsearch 6.4.2
Found this site: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/search-request-body.html
The documentation shows how to perform the search and it even has an example.
We can also use the parameter size in order to specify the amount of hits to return.
Putting all together:
We can use _cat to see the available options:
Checking the indices we notice bank and quotes. The ?v after indices displays the headers
We can use the pretty parameter (discussed in the API documentation) to get a nice output of the JSON data.
From the output above, we can see there are 253 total hits, so we are going to use the size and _search parameter we discussed (learned from the API documentation)
The following also worked, I got this from the API documentation on how to search:
I learned a lot about elasticsearch, so now its time to see what we got. Please note that the reason I am using the word "clave" is because we got that from the initial picture
Getting a shell
ssh to the box user the decoded credentials user: security pass: spanish.is.key
Privilege Escalation
The server is listening on port 5601
Using ssh port forwarding to checkout what's running on that port.
Checking out port 5602, we notice it's running Kibana version 6.4.2
Google search on Kibana 6.4.2 takes to the following interesting GitHub page describing a CVE
Description: A Local File Inclusion on Kibana found by CyberArk Labs, the LFI can be use to execute a reverse shell on the Kibana server with the following payload:
The article has this POC for the reverse shell
I used that code and modified it to get a reverse shell on my box. I placed the script in /dev/shm/ and I called it shell.js
To triggered the reverse shell, I used curl with the link in quotes to avoid bash from interpreting anything.
And... I got a shell as user kibana
This box has the full ELK installed (Elastic, Logstash and Kibana)
Elastic uses port 9200 and its run by user elastic
Logstash uses port 9600 and its run by user root
Kibana uses port: 5601 and its run by user kibana
Basic Enumeration shows we have access to the logstash configurations.
Based on the configuration files, we should be able to create a file under the directory /opt/kibana and name the file logstash_{whatever you want here} using the following format on its contents:
Ejecutar comando : {whatever commands we want here}The \s on the filter.conf means a literal space.
Getting a reverse shell with root privileges since logstash is running as root.
Last updated