TryHackMe ! Kiba // Exploiting Kibana - JavaScript Prototype Pollution

Disclaimer

This is educational purpose video only. I did not harm anyone I just do ctfs and make that walkthrough and explain what of the method here in use, so please don't use this because hacking is crime if you do this then it's can land you in jail.
I'm not support any kind of illegle or malicious hacking.

========================
kiba
-----------
Identify the critical security flaw in the data visualization dashboard, that allows execute remote code execution.

---------------------------------------------
1. What is the vulnerability that is specific to programming languages with prototype-based inheritance?
2. What is the version of visualization dashboard installed in the server?
3. What is the CVE number for this vulnerability? This will be in the format: CVE-0000-0000
5. Capabilities is a concept that provides a security system that allows "divide" root privileges into different values
6. How would you recursively list all of these capabilities?

-------------------------------
#yesspider

please support me on patreon

--------------------------------------------------

00:00-intro
00:32-scan ports using nmap
02:47-enumeration
06:52-search vulnerability of kibana
12:00-exploit kibana (CVE-2019-7609)
19:26-privilege escalation