# Twiggy

## Information Gathering

### Service Enumeration

`sudo ./nmapAutomator.sh 192.168.63.62 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FW16wi5eZrQ1t2R6OAMK0%2Fimage.png?alt=media\&token=14c0a773-1360-4b24-910b-33070a0a8c5e)

### HTTP (Port 80)

Mezzanine CMS running.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FRVYTmF7XyEarRXz2DbpN%2Fimage.png?alt=media\&token=ea68a433-954c-4ede-bb52-882e2fcd9a42)

### HTTP (Port 8000)

Doesn't look like anything useful.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FmCVMFa0XCHChuQpPWwqY%2Fimage.png?alt=media\&token=64ba97cc-2893-44bf-9891-d058995062fc)

But when we look at the response in burp, we see something interesting.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FXvdWwJVtLtDTKKGFPtJY%2Fimage.png?alt=media\&token=d0d0acb6-eab9-4589-9fa7-7d96599e7ce3)

Looks like this is running `salt-api/3000-1`.

## Exploit

A quick google search and we find that Saltstack 3000.1 is vulnerable to authentication bypass/remote code execution.&#x20;

{% embed url="<https://www.exploit-db.com/exploits/48421>" %}

However, the script isn't working well and I found a better script.

{% embed url="<https://github.com/jasperla/CVE-2020-11651-poc>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FbbEMFQCLlzJpWAWtNrXW%2Fimage.png?alt=media\&token=726ae819-f639-4e48-a5ca-32465cb540c4)

Nice, looks like it is vulnerable.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FOMT8772OtZjufrnaUrFm%2Fimage.png?alt=media\&token=c36d4237-a831-4d78-99ad-4547dffea8f7)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F4rZ5bMl95rreumDBDCKN%2Fimage.png?alt=media\&token=27505b82-baba-46c2-a1a9-75e929cfeb54)

Hmm...That didn't work, maybe this machine doesn't have `nc`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FZwJqwOeeBvV6M5Q7kJ9p%2Fimage.png?alt=media\&token=629627e6-aa6a-4650-ae49-bba27483eb5d)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FnT1ls0nrZGE4d7gYrdNg%2Fimage.png?alt=media\&token=f8e97711-f522-4594-8841-bac1cdbaf54e)

Seems like our new payload works and since we are root, there's no need for privesc!
