CVE-2020-11651 PoC — SaltStack Salt 安全漏洞

Source

https://github.com/RakhithJK/CVE-2020-11651

Associated Vulnerability

Title:SaltStack Salt 安全漏洞 (CVE-2020-11651)
Description:SaltStack Salt是SaltStack公司的一套开源的用于管理基础架构的工具。该工具提供配置管理、远程执行等功能。 SaltStack Salt 2019.2.4之前版本和3000.2之前的3000.x版本中存在安全漏洞，该漏洞源于salt-master进程的ClearFuncs类没有正确验证方法的调用。远程攻击者可利用该漏洞检索用户令牌或执行任意命令。

Description

PoC for CVE-2020-11651

Readme

# CVE-2020-11651
PoC for CVE-2020-11651

Requires Python3 tested on 3.8

`python3.8 -m pip install pyzmq msgpack`


```
⇒  python3.8 poc.py -h                                                      
usage: poc.py [-h] [-p PORT] [-c CMD] [-k] [-m] [-r READ] [-w WRITE] [-f FILE] server [server ...]

Exploit CVE-2020-11651

positional arguments:
  server                Target Server IP or Host

optional arguments:
  -h, --help            show this help message and exit
  -p PORT, --port PORT  Target Port (Default=4506)
  -c CMD, --cmd CMD     Command to execute
  -k, --key             Retrieve Root Key
  -m, --minions         Run CMD on all active minions
  -r READ, --read READ  Read a file from the Salt Master
  -w WRITE, --write WRITE
                        Write a file from the Salt Master
  -f FILE, --file FILE  Used with --write, local file to write to Salt Master

Example: poc.py -k 127.0.0.1 (Read the root key)
```

File Snapshot


 [4.0K]  /data/pocs/a7bda8bf190702c17edeb40edc96f2964a8acb5b
├── [1.0K]  LICENSE
├── [6.3K]  poc.py
└── [ 935]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!