GitHubPsMapExec

Kiba

Nmap

sudo nmap 10.10.176.245 -p- -sS -sV                                           

PORT     STATE SERVICE      VERSION
22/tcp   open  ssh          OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http         Apache httpd 2.4.18 ((Ubuntu))
5044/tcp open  lxi-evntsvc?
5601/tcp open  esmagent?

Port 80 takes us to the following:

http://10.10.176.245/index.html

The sentance is a possible hint for later regarding capabilities. Otherwise I was unable to enumerate further interesting directories with Gobuster.

On port 5601 we have Kibana installed.

http://10.10.176.245:5601/app/kibana#/home?_g=()

Checking the management pane shows we are running on version 6.5.4

http://10.10.176.245:5601/app/kibana#/management?_g=()

Research related exploits we come across a RCE exploit that effect versions prior to 6.6.

LogoGitHub - mpgn/CVE-2019-7609: RCE on Kibana versions before 5.6.15 and 6.6.0 in the Timelion visualizerGitHub

As per the exploit head over to the Timelion pane in Kibana and paste the following payload:

Swapping out the IP and port where required.

Hit run and then proceed to the 'Canvas' pane. Shortly after we should recieve a shell back on our netcat listener.

From here we can check all capabilities with:

This reveals a python binary in /home/kiba/.hackmeplease. We can run the following command to launch a Python shell as root.

Last updated