# Consul

> Consul is a service mesh and discovery tool. Attackers enumerate services, exploit unauthenticated APIs, execute commands via health checks, escalate privileges, and move laterally through registered nodes

- **URL:** https://hackindex.io/services/consul
- **Type:** Service
- **Default ports:** 8500, 8501
- **Tags:** consul, api, service-discovery, http, rpc, network
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

HashiCorp Consul is a service mesh and service discovery tool used in modern infrastructure for health checking, key-value storage, and network configuration. The HTTP API runs on **TCP port 8500** and the DNS interface on **TCP/UDP port 8600**. Nmap identifies port 8500 as `http`.

Consul is a goldmine during internal assessments because it acts as a central registry for services, configurations, and secrets. When ACLs are not enabled (the default), the entire key-value store, service catalog, and registered health checks are readable by anyone. The KV store frequently contains database credentials, API keys, TLS certificates, and application configuration. Consul also supports script-based health checks, which can be abused for remote code execution when the agent's `enable_script_checks` setting is active.

Enumeration starts with querying the HTTP API at `/v1/catalog/services` to list all registered services and `/v1/kv/?recurse` to dump the key-value store. The `/v1/agent/members` endpoint reveals cluster topology and node details. Checking for write access to the KV store and the ability to register services or modify health checks determines the full extent of impact.

## Phases

- [Enumeration](https://hackindex.io/services/consul/enumeration.md): Enumerate Consul API for KV secrets, nodes, services, and ACL status (1 guides)
- [Exploitation](https://hackindex.io/services/consul/exploitation.md): RCE via service health checks, exec API, and ACL token theft (1 guides)