Consul

HashiCorp Consul is a service mesh and service discovery tool used in modern infrastructure for health checking, key-value storage, and network configuration. The HTTP API runs on TCP port 8500 and the DNS interface on TCP/UDP port 8600. Nmap identifies port 8500 as http.

Consul is a goldmine during internal assessments because it acts as a central registry for services, configurations, and secrets. When ACLs are not enabled (the default), the entire key-value store, service catalog, and registered health checks are readable by anyone. The KV store frequently contains database credentials, API keys, TLS certificates, and application configuration. Consul also supports script-based health checks, which can be abused for remote code execution when the agent's enable_script_checks setting is active.

Enumeration starts with querying the HTTP API at /v1/catalog/services to list all registered services and /v1/kv/?recurse to dump the key-value store. The /v1/agent/members endpoint reveals cluster topology and node details. Checking for write access to the KV store and the ability to register services or modify health checks determines the full extent of impact.