Exploiting Elasticsearch

Sometimes, while doing a pentest, we may also come across some of the services running on various port numbers; one such service is what we will look at in this recipe. Elasticsearch is a Java-based, open source search enterprise engine. It can be used to search any kind of document in real-time.

In 2015, an RCE exploit came for Elasticsearch, which allowed hackers to bypass the sandbox and execute remote commands. Let's see how.

How to do it...

Let's perform the following steps:

1. The default port is 9200. Start the Metasploit console:

2. Search for the Elasticsearch exploit using the following command:

 search elasticsearch

The output of the preceding command is shown in the following screenshot...