Directory Traversal in SaltStack Salt salt-master ClearFuncs

This repository is a small standalone Python exploit for SaltStack CVE-2020-11651 and CVE-2020-11652. It contains one code file (Poc.py) and a brief README noting it is an updated version of an existing PoC. The script is not part of a larger exploit framework. Structure and purpose: Poc.py is the sole operational component and serves as a command-line exploit tool. It initializes a Salt ReqChannel configured as a fake minion using ZeroMQ transport, targets a Salt master at a user-specified IP/port (default 127.0.0.1:4506), and attempts to retrieve the master root key by sending the unauthenticated _prep_auth_info request. If successful, it uses the recovered key to invoke privileged Salt wheel and runner functions. Main capabilities: (1) arbitrary file read using wheel/file_roots.read, including direct user-specified paths via --read; (2) arbitrary command execution without output using runner/salt.cmd with cmd.exec_code and embedded Python subprocess.call(..., shell=True); (3) command execution with output retrieval by redirecting stdout/stderr to a temporary file under /tmp and then reading that file back through file_roots.read; and (4) reverse shell delivery via --shell, preferring a Python socket-based reverse shell to /bin/bash and falling back to a netcat FIFO shell if Python is unavailable. Operational details: The exploit generates Salt job IDs from UTC timestamps, uses short timeouts, and relies on temporary files such as /tmp/out_<timestamp>, /tmp/pycheck, and /tmp/f on the target. Reverse shell mode requires the operator to supply --lhost and optionally --lport (default 4444). The code is functional and offensive rather than merely demonstrative, but payload customization is limited to command strings and listener parameters, so OPERATIONAL is the best fit rather than WEAPONIZED.

This repository contains a Python proof-of-concept exploit for SaltStack Salt Master vulnerabilities CVE-2020-11651 and CVE-2020-11652. The main file, 'CVE-2020-11652-fix.py', allows an attacker to connect to a vulnerable Salt Master server over the network (default port 4506), extract the root key, and perform a range of post-exploitation actions. These include reading arbitrary files, uploading files (with a default target of the root user's crontab for persistence), executing arbitrary shell commands on the master or all minions, and spawning a reverse shell to a remote host. The exploit leverages unauthenticated access to internal SaltStack commands and is effective against unpatched Salt Master versions prior to 2019.2.4 or between 3000 and 3000.2. The repository also includes a README with usage instructions and references to the original exploit sources. No detection or fake code is present; this is a functional exploit with operational-level maturity.

This repository contains a Python exploit script (CVE-2020-11652.py) targeting SaltStack Salt Master servers vulnerable to CVE-2020-11651 and CVE-2020-11652. The exploit leverages unauthenticated access to the Salt Master ZeroMQ transport (default port 4506) to extract the root key, which is then used to perform privileged operations. The script supports multiple attack capabilities: reading arbitrary files from the server, uploading files (potentially overwriting critical files like crontabs), executing arbitrary shell commands as root on the master or all minions, and spawning a reverse shell to an attacker-controlled host. The exploit is operational and requires the attacker to specify the target's IP, port, and desired action via command-line arguments. The README provides usage examples for each capability. No detection or fake code is present; the script is a functional exploit for the specified SaltStack vulnerabilities.

This repository contains a Python exploit (exp.py) targeting SaltStack Salt Master servers vulnerable to CVE-2020-11651 and CVE-2020-11652. The exploit leverages unauthenticated access to the Salt Master ZeroMQ port (default 4506) to extract the root key and perform privileged operations. Capabilities include: - Remote code execution as root on the Salt Master or all minions (via arbitrary command execution) - Arbitrary file read from the Salt Master - Arbitrary file write (upload) to the Salt Master, with a default target of the root user's crontab - Reverse shell to an attacker-controlled host and port The exploit is operational and requires the attacker to specify the target Salt Master IP and port, as well as the desired action (command execution, file read/write, or reverse shell). The README provides usage examples for each capability. The code is self-contained and does not rely on external frameworks, but does require the Salt Python libraries to be installed. The main entry point is exp.py, which parses command-line arguments and executes the chosen attack vector. The exploit is effective against SaltStack Salt versions prior to 2019.2.4 and between 3000 and 3000.2, primarily on Linux platforms.