8086 - Pentesting InfluxDB

Support HackTricks and get benefits!
Basic Information
InfluxDB is an open-source time series database (TSDB) developed by the company InfluxData.
A time series database (TSDB) is a software system that is optimized for storing and serving time series through associated pairs of time(s) and value(s).
Time series datasets are relatively large and uniform compared to other datasets―usually being composed of a timestamp and associated data. Time series datasets can also have fewer relationships between data entries in different tables and don't require indefinite storage of entries. The unique properties of time series datasets mean that time series databases can provide significant improvements in storage space and performance over general purpose databases. For instance, due to the uniformity of time series data, specialized compression algorithms can provide improvements over regular compression algorithms designed to work on less uniform data. Time series databases can also be configured to regularly delete old data, unlike regular databases which are designed to store data indefinitely. Special database indices can also provide boosts in query performance. (From here).
Default port: 8086
1
PORT     STATE SERVICE VERSION
2
8086/tcp open  http    InfluxDB http admin 1.7.5
Copied!
Enumeration
From a pentester point of view this another database that could be storing sensitive information, so it's interesting to know how to dump all the info.
Authentication
InfluxDB might require authentication or not
1
# Try unauthenticated
2
influx -host 'host name' -port 'port #'
3
> use _internal
Copied!
If you get an error like this one: ERR: unable to parse authentication credentials it means that it's expecting some credentials.
1
influx –username influx –password influx_pass
Copied!
There was a vulnerability influxdb that allowed to bypass the authentication: CVE-2019-20933​
Manual Enumeration
The information of this example was taken from here.
Show databases
The found databases are telegraf and _internal (you will find this one everywhere)
1
> show databases
2
name: databases
3
name
4
----
5
telegraf
6
_internal
Copied!
Show tables/measurements
As the InfluxDB documentation explains, SQL measurements can be thought of as SQL tables. As the measurement names above suggest, each one contains information which pertains to a specific entity
1
> show measurements
2
name: measurements
3
name
4
----
5
cpu
6
disk
7
diskio
8
kernel
9
mem
10
processes
11
swap
12
system
Copied!
Show columns/field keys
The field keys are like the columns of the database
1
> show field keys
2
name: cpu
3
fieldKey         fieldType
4
--------         ---------
5
usage_guest      float
6
usage_guest_nice float
7
usage_idle       float
8
usage_iowait     float
9
​
10
name: disk
11
fieldKey     fieldType
12
--------     ---------
13
free         integer
14
inodes_free  integer
15
inodes_total integer
16
inodes_used  integer
17
​
18
[ ... more keys ...]
Copied!
Dump Table
And finally you can dump the table doing something like
1
select * from cpu
2
name: cpu
3
time                cpu       host   usage_guest usage_guest_nice usage_idle        usage_iowait        usage_irq usage_nice usage_softirq        usage_steal usage_system        usage_user
4
----                ---       ----   ----------- ---------------- ----------        ------------        --------- ---------- -------------        ----------- ------------        ----------
5
1497018760000000000 cpu-total ubuntu 0           0                99.297893681046   0                   0         0          0                    0           0.35105315947842414 0.35105315947842414
6
1497018760000000000 cpu1      ubuntu 0           0                99.69909729188728 0                   0         0          0                    0           0.20060180541622202 0.10030090270811101
Copied!
In some testing with the authentication bypass it was noted that the name of the table needed to be between double quotes like: select * from "cpu"
Automated Authentication
1
msf6 > use auxiliary/scanner/http/influxdb_enum
Copied!
Support HackTricks and get benefits!

Network Services Pentesting - Previous

8009 - Pentesting Apache JServ Protocol (AJP)

Next - Network Services Pentesting

8089 - Pentesting Splunkd

Last modified 19d ago

Copy link

Contents

Automated Authentication