Zabbix

Zabbix is an enterprise network monitoring platform consisting of a server, agents, and a web frontend. The Zabbix agent listens on TCP port 10050 and the Zabbix server/proxy on TCP port 10051. The web interface typically runs on standard HTTP/HTTPS ports. Nmap identifies the agent as zabbix-agent.

Zabbix is a high-value target because it has deep access to monitored infrastructure. The agent can execute commands on the host it runs on, and the server stores credentials for all monitored systems. Default credentials on the web frontend (Admin:zabbix) are a common finding. When the agent is misconfigured to accept connections from any host (not just the Zabbix server), an attacker can query system information and, if EnableRemoteCommands is active, execute arbitrary operating system commands on the agent host.

Enumeration starts with checking the web frontend for default credentials, then testing agent accessibility with zabbix_get to query items like system.hostname, system.uname, and vfs.file.contents[/etc/passwd]. The Zabbix API (/api_jsonrpc.php) provides authenticated access to host inventories, stored credentials, and configuration data. Testing for remote command execution on agents and checking for SQL injection in older Zabbix versions are standard exploitation steps.