Unauthenticated RCE in SaltStack Salt ClearFuncs

This repository is a small standalone Python exploit for SaltStack CVE-2020-11651 and CVE-2020-11652. It contains one code file (Poc.py) and a brief README noting it is an updated version of an existing PoC. The script is not part of a larger exploit framework. Structure and purpose: Poc.py is the sole operational component and serves as a command-line exploit tool. It initializes a Salt ReqChannel configured as a fake minion using ZeroMQ transport, targets a Salt master at a user-specified IP/port (default 127.0.0.1:4506), and attempts to retrieve the master root key by sending the unauthenticated _prep_auth_info request. If successful, it uses the recovered key to invoke privileged Salt wheel and runner functions. Main capabilities: (1) arbitrary file read using wheel/file_roots.read, including direct user-specified paths via --read; (2) arbitrary command execution without output using runner/salt.cmd with cmd.exec_code and embedded Python subprocess.call(..., shell=True); (3) command execution with output retrieval by redirecting stdout/stderr to a temporary file under /tmp and then reading that file back through file_roots.read; and (4) reverse shell delivery via --shell, preferring a Python socket-based reverse shell to /bin/bash and falling back to a netcat FIFO shell if Python is unavailable. Operational details: The exploit generates Salt job IDs from UTC timestamps, uses short timeouts, and relies on temporary files such as /tmp/out_<timestamp>, /tmp/pycheck, and /tmp/f on the target. Reverse shell mode requires the operator to supply --lhost and optionally --lport (default 4444). The code is functional and offensive rather than merely demonstrative, but payload customization is limited to command strings and listener parameters, so OPERATIONAL is the best fit rather than WEAPONIZED.

This repository contains a Python exploit script (CVE-2020-11651-11652-add_user.py) targeting SaltStack Salt master servers vulnerable to CVE-2020-11651 and CVE-2020-11652. The exploit leverages an authentication bypass and remote code execution flaw to connect to the Salt master (default port 4506) and, using unauthenticated commands, directly read and write to critical system files (/etc/passwd and /etc/shadow). This allows the attacker to add a new user with arbitrary credentials or replace the root user, effectively granting full system access. The script supports reading arbitrary files as well. The repository includes a README with usage instructions and a demonstration of successful exploitation. The exploit is operational, requiring only network access to a vulnerable Salt master and does not depend on any exploit framework.

This repository is a proof-of-concept exploit for CVE-2020-11651, a critical authentication bypass vulnerability in SaltStack Salt Master. The main exploit is implemented in 'poc.py', a Python 3 script that uses the pyzmq and msgpack libraries to communicate directly with the Salt Master over its ZeroMQ (ZMQ) interface (default port 4506). The script provides several capabilities: - Retrieve the Salt Master's root key without authentication. - Execute arbitrary shell commands on all connected minions. - Read arbitrary files from the Salt Master filesystem. - Write arbitrary files to the Salt Master filesystem. The script is operated via command-line arguments, allowing the user to specify the target server, port, and desired action (key retrieval, command execution, file read/write). The exploit leverages the lack of authentication on certain internal commands exposed by the Salt Master, making it highly impactful. The repository contains only one code file ('poc.py'), a README with usage instructions, a LICENSE, and a .gitignore. No hardcoded IPs or domains are present; the target is specified at runtime. The exploit is operational and demonstrates real-world impact, but is not weaponized for mass exploitation.

This repository contains a proof-of-concept exploit (exploit.py) for SaltStack Salt vulnerabilities CVE-2020-11651 and CVE-2020-11652. The exploit targets Salt master servers that have not been patched for these vulnerabilities. It leverages authentication bypass and directory traversal flaws to obtain the Salt master root key, read and write arbitrary files on the master, upload files (with path traversal), and execute arbitrary commands on the master and all connected minions. The exploit operates over the Salt master's default management port (4506/tcp) and requires the attacker to have network access to the target. The README.md provides detailed usage instructions and examples, including reading sensitive files (e.g., /etc/shadow), uploading files to privileged locations, and executing shell commands. The exploit is written in Python and requires the Salt Python library. The repository is structured simply, with a single exploit script and a comprehensive README. No detection or fake code is present; this is a functional exploit for the referenced CVEs.

This repository contains a Python exploit (exp.py) targeting SaltStack Salt Master servers vulnerable to CVE-2020-11651 and CVE-2020-11652. The exploit leverages unauthenticated access to the Salt Master ZeroMQ port (default 4506) to extract the root key and perform privileged operations. Capabilities include: - Remote code execution as root on the Salt Master or all minions (via arbitrary command execution) - Arbitrary file read from the Salt Master - Arbitrary file write (upload) to the Salt Master, with a default target of the root user's crontab - Reverse shell to an attacker-controlled host and port The exploit is operational and requires the attacker to specify the target Salt Master IP and port, as well as the desired action (command execution, file read/write, or reverse shell). The README provides usage examples for each capability. The code is self-contained and does not rely on external frameworks, but does require the Salt Python libraries to be installed. The main entry point is exp.py, which parses command-line arguments and executes the chosen attack vector. The exploit is effective against SaltStack Salt versions prior to 2019.2.4 and between 3000 and 3000.2, primarily on Linux platforms.

This repository contains a Python proof-of-concept exploit for CVE-2020-11651, a critical authentication bypass vulnerability in SaltStack Salt masters. The main file, 'CVE-2020-11651.py', leverages the vulnerability to perform unauthenticated remote code execution (RCE) on the Salt master and/or all connected minions. The exploit works by connecting to the Salt master's ZeroMQ transport (default port 4506), retrieving the root key, and then using it to execute arbitrary shell commands either on the master or broadcast to all minions. The exploit can be used to fetch the root key, execute a command on the master, or send a command to all minions. The README provides usage instructions and example commands, including how to use netcat for reverse shells. The repository is operational and demonstrates real-world exploitation of the vulnerability, requiring only the Salt Python library and network access to the target. No detection or patching scripts are included; the focus is on exploitation.