Full Report
We have access through port 9200. We have code execution through port 5601. Reconnaissance is complete, CVEs have been exploited, and Kibana has been compromised. Over the past three posts, we proved that we could get in. Now we prove what happens after.
Analysis Summary
# Tool/Technique: RAVEN (specifically raven-es)
## Overview
RAVEN is an offensive security toolset developed by SpiderLabs for interacting with and exploiting Elasticsearch and Kibana environments. Following initial access and RCE, RAVEN is used to automate data exfiltration (heist), maintain persistence via API keys, and perform post-exploitation maneuvers within a compromised Elastic Stack.
## Technical Details
- **Type:** Attack Tool / Framework
- **Platform:** Linux / Windows / macOS (Python/Docker-based environments targeting Elasticsearch/Kibana)
- **Capabilities:** Bulk data exfiltration, targeted index extraction, API key manipulation, and persistence establishment.
- **First Seen:** August 2024 (SpiderLabs documentation)
## MITRE ATT&CK Mapping
- **[TA0009 - Collection]**
- [T1560 - Archive Collected Data]
- [T1530 - Data from Cloud Storage Object]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
- **[TA0003 - Persistence]**
- [T1136.003 - Create Account: Cloud Account (API Keys)]
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery]
## Functionality
### Core Capabilities
- **Bulk Data Exfiltration:** Uses the `_exfil_` module to paginate through entire indices using the Scroll API (pre-v7.10) or Point-in-Time (PIT) API (v7.10+).
- **NDJSON Export:** Writes stolen documents to disk in Newline Delimited JSON format, preserving data structure for easy re-import.
- **Targeted Extraction:** Allows attackers to specify individual indices (e.g., `_users_`) for surgical data theft.
- **Resumption Support:** Includes a `--resume` flag that uses state files to continue interrupted downloads, essential for large-scale databases.
### Advanced Features
- **Reindexing (Mirroring):** The `--to local-es` option allows direct transfer of data from the victim's cluster to the attacker’s cluster, maintaining all mappings and field types.
- **Traffic Blending:** The `--batch-size` flag allows the user to tune the frequency and volume of requests to either prioritize speed or evade detection by blending with normal application traffic.
- **Credential-Independent Access:** (Implicit in context) Generation of API keys to ensure access remains even if user passwords are rotated.
## Indicators of Compromise
- **File Names:** `loot/*.ndjson`, state files for resumption.
- **Network Indicators:** Requests to `[victim-ip]:9200/_search/scroll` or `[victim-ip]:9200/_pit`. Defanged: `hxxp://attacker-es[.]local:9200`.
- **Behavioral Indicators:**
- Unusual volume of GET/POST requests to Elasticsearch APIs involving "scroll" or "point in time."
- Frequent batch queries (default 1,000 documents) originating from a single internal or external IP.
- Creation of high-privilege API keys without associated administrative change tickets.
## Associated Threat Actors
- **SpiderLabs (Red Team/Research):** Primarily documented as a tool for authorized penetration testing and security research.
## Detection Methods
- **Behavioral Detection:** Monitor Elasticsearch logs for an anomaly in "Scroll" or "PIT" API usage, especially from unexpected source IPs or unauthorized service accounts.
- **Network Monitoring:** Look for large outbound flows of NDJSON data or high-frequency queries to Kibana/Elasticsearch ports (5601/9200).
- **Audit Logs:** Enable and monitor Elasticsearch "Audit Logging" (X-Pack) to identify the creation of new API keys or access to sensitive indices like `_users_`.
## Mitigation Strategies
- **Authentication & Authorization:** Enable X-Pack security and ensure no clusters are exposed without authentication (binding to `localhost` or using strong RBAC).
- **Network Segmentation:** Restrict access to ports 9200 and 5601 to authorized management IPs or application servers only via firewalls/ACLs.
- **Disable Unused APIs:** If the Scroll or PIT APIs are not required for business operations, consider restricting their use through proxy layers or Web Application Firewalls (WAFs).
## Related Tools/Techniques
- **Elasticsearch Scroll API:** The native feature abused for pagination.
- **Logstash:** Often used legitimately for similar data movement, which RAVEN mimics.
- **Kibana RCE (CVE-2019-7609 and others):** Common entry points mentioned as prerequisites for using RAVEN’s advanced features.