Kiba

This room is based on the vulnerability in a data visualization dashboard for Elasticsearch named Kibana. The questions are structured in a very beginner-friendly manner that guides us in the right direction. By the end of this room, we will get a rough idea of how to perform attacks using CVE's.

So, let's begin!

1. What is the vulnerability that is specific to programming languages with prototype-based inheritance?

The first thing that we do after deploying our machine is accessing the IP address and check the content over there.

Img. Homepage

Below the image, we can see a string that gives us a hint towards something called as linux capabilities. So, we can google what it is exactly and the first thing that comes up is that it is special attributes in the Linux kernel that grant processes and binary executables specific privileges that are normally reserved for processes whose effective **user ID** is 0 (The root user, and only the root user, has **UID** 0).. As we don't have access to the machine this information is not useful right now but can be helpful once we get the machine's access.

On the other side, we can start an nmap scan to determine all the ports that are open on the machine. Meanwhile, we can search for what the first question is asking i.e. a vulnerability related to prototype-based inheritance programming languages. With only one google search we can find out the details of this vulnerability which is explained here. Also, the name of this vulnerability is the answer to the first question.

2. What is the version of visualization dashboard installed in the server?

We can now check the results of nmap.

From these results, we can see that some service is running on port 5601. So, we can go back to our browser and see that the Kibana dashboard is running at http://<ip_address:5601/app/kibana'.

Img. Kibana Welcome Page

We can select the option 'Try our sample data' and proceed to access the dashboard. As per the question, we need to now look for the version of Kibana running on the machine (which will be helpful further to search for vulnerabilities) which can be found in the management section:

Img. Kibana Management Page

We can now submit this version number as the answer to the second question.

3. What is the CVE number for this vulnerability? This will be in the format: CVE-0000-0000

Now, that we know the service and its version we can search for related vulnerabilities. In the beginning, we came across a vulnerability related to prototype-based inheritance vulnerability. So, we can look for that kind of vulnerability in Kibana. After some googling, we can find an entire article on this vulnerability which can lead to an RCE here. We can easily get the CVE number and exploitation method from the same website. As for this question, we can submit the CVE number found on the website as the answer to the third question.

4. Compromise the machine and locate user.txt

In the article, it is very beautifully explained about the exploit and how we can perform it. The basic steps that we need to follow in order to exploit are as follows:

  1. Go to Timelion and enter the following payload:

  2. Update the IP with our local machine's IP address and port number of our choice and click on the play-like button.

  3. Start a listener on the mentioned port on our local machine.

  4. Go to Canvas on the Kibana dashboard and wait for some time to get a reverse shell on our listener.

P.S. The above payload on the article did not work for me, so I looked for some other payload and found a git repository over here and used those payloads.

This user.txt flag can be submitted as the answer to the fourth question.

5. Capabilities is a concept that provides a security system that allows "divide" root privileges into different values

Though we don't need to give an answer to this question, it definitely gives us a hint that we need to use Linux Capabilities for privilege escalation.

6. How would you recursively list all of these capabilities?

We can simply do a google search to find the answer to this question. After some research, we can find this website where we can find the simple command using which we can list all the Linux capabilities recursively.

Do note that when you run the command add2> /dev/nullelse you'll see a lot of operation not supported results.

Here, we can see an odd file /home/kiba/.hackmeplease/python3. On checking it's permission:

We can see that it is owned by root. So, we can try to use this file to get root access. We can go to GTFOBins and check the python capabilities exploit to get root access.

7. Escalate privileges and obtain root.txt

Though on GTFOBins the payload is for python 2 we can change it for python3 and use it.

And once we execute the command, we will get the root shell:

Now, we can read the root flag and submit it to complete the room!

Links Referred

  1. TryHackMe - Kiba: https://tryhackme.com/room/kiba

  2. Prototype Pollution Explained: https://github.com/Kirill89/prototype-pollution-explained

  3. RCE in Kibana: https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019-7609/

  4. Payloads for Kibana RCE: https://github.com/mpgn/CVE-2019-7609

  5. Linux Capabilities Commands: https://www.vultr.com/docs/working-with-linux-capabilities?__cf_chl_jschl_tk__=92b3dbab2c797cb4228927692a7bb187a9eeb61a-1598977955-0-AXZZjx81Q8Zt90gyrUYyMTt5KcXg1ndzEH86_mraDiZccs_tLTQ47VIxN5vz0YyLcaPwRhXsCeGJTaj_cAQydOPTLs0wGkzWA3bTIQChlvhjU5xJ-SNS2mCkXNMipUJZaxDpT4QrNmxBzhdxlyu7WJyY20jBHQUxyMsMH-lRvkoNgITcYD_xqmyg-LwPZDEtGatJ5hynYg1qPnY7CgRvsJ-uJhrlrA1Z8TOlZIEsiouWtBjlwn6tvFHpDaE-Ca_hGYSLuvNCSPliBFy7VH_37CuHgruzzCE856o3O8Xv34_Ac7UYW1Ar6Iotot0N7Fk7unjbJINAhZSwCEKVr6__pehxQbMYzBre3pSeXgXQNHj1aA8YvZTlABjAcfcOB-ejxg

  6. GTFOBins: https://gtfobins.github.io/

PreviousGit HappensNextBreak Out of The Cage

Last updated

Was this helpful?