search

HTB - Haystack

Haystack

hashtag
Getting Root:

  1. Start with nmap and discovered port 22, 80, 9200

  2. On port 80 we get a an image with base64 encoded talking about key

  3. On port 9200 we use elastic search to find credentials to ssh to the box and user flag

  4. To escalate privileges, we use CVE-2018-17246 to get user kibana who has access to logstash which is running as root

  5. Create a file based on the logstash configuration files and get a reverse shell as root

hashtag
Nmap

hashtag
Enumeration

hashtag
Checking Port 80

hashtag
Checking the image

hashtag
Google Translate

hashtag
Gobuster on port 80 did not returned anything. I also tried with different User Agent

hashtag
Checking port 9200

hashtag
Gobuster

hashtag
Research on Elasticsearch 6.4.2

Found this site: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/search-request-body.htmlarrow-up-right

The documentation shows how to perform the search and it even has an example.

We can also use the parameter size in order to specify the amount of hits to return.

hashtag
Putting all together:

We can use _cat to see the available options:

Checking the indices we notice bank and quotes. The ?v after indices displays the headers

We can use the pretty parameter (discussed in the API documentation) to get a nice output of the JSON data.

From the output above, we can see there are 253 total hits, so we are going to use the size and _search parameter we discussed (learned from the API documentation)

The following also worked, I got this from the API documentation on how to search:

I learned a lot about elasticsearch, so now its time to see what we got. Please note that the reason I am using the word "clave" is because we got that from the initial picture

hashtag
Getting a shell

ssh to the box user the decoded credentials user: security pass: spanish.is.key

hashtag
Privilege Escalation

The server is listening on port 5601

Using ssh port forwarding to checkout what's running on that port.

Checking out port 5602, we notice it's running Kibana version 6.4.2

Google search on Kibana 6.4.2 takes to the following interesting GitHub page describing a CVE

LogoGitHub - mpgn/CVE-2018-17246: CVE-2018-17246 - Kibana LFI < 6.4.3 & 5.6.13GitHubchevron-right

Description: A Local File Inclusion on Kibana found by CyberArk Labs, the LFI can be use to execute a reverse shell on the Kibana server with the following payload:

The article has this POC for the reverse shell

I used that code and modified it to get a reverse shell on my box. I placed the script in /dev/shm/ and I called it shell.js

To triggered the reverse shell, I used curl with the link in quotes to avoid bash from interpreting anything.

And... I got a shell as user kibana

hashtag
This box has the full ELK installed (Elastic, Logstash and Kibana)

Elastic uses port 9200 and its run by user elastic

Logstash uses port 9600 and its run by user root

Kibana uses port: 5601 and its run by user kibana

hashtag
Basic Enumeration shows we have access to the logstash configurations.

Based on the configuration files, we should be able to create a file under the directory /opt/kibana and name the file logstash_{whatever you want here} using the following format on its contents: Ejecutar comando : {whatever commands we want here}The \s on the filter.conf means a literal space.

Getting a reverse shell with root privileges since logstash is running as root.

PreviousHTB - BastionNextHTB - Bashed

Last updated