# Zabbix

> Zabbix is a network monitoring platform. Attackers enum its web UI, exploit weak creds or CVEs, abuse agent configs, escalate via scripts, and pivot using stored host credentials

- **URL:** https://hackindex.io/services/zabbix
- **Type:** Service
- **Default ports:** 10050, 10051
- **Tags:** zabbix, monitoring, web, snmp, linux, network
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

Zabbix is an enterprise network monitoring platform consisting of a server, agents, and a web frontend. The Zabbix agent listens on **TCP port 10050** and the Zabbix server/proxy on **TCP port 10051**. The web interface typically runs on standard HTTP/HTTPS ports. Nmap identifies the agent as `zabbix-agent`.

Zabbix is a high-value target because it has deep access to monitored infrastructure. The agent can execute commands on the host it runs on, and the server stores credentials for all monitored systems. Default credentials on the web frontend (`Admin:zabbix`) are a common finding. When the agent is misconfigured to accept connections from any host (not just the Zabbix server), an attacker can query system information and, if `EnableRemoteCommands` is active, execute arbitrary operating system commands on the agent host.

Enumeration starts with checking the web frontend for default credentials, then testing agent accessibility with `zabbix_get` to query items like `system.hostname`, `system.uname`, and `vfs.file.contents[/etc/passwd]`. The Zabbix API (`/api_jsonrpc.php`) provides authenticated access to host inventories, stored credentials, and configuration data. Testing for remote command execution on agents and checking for SQL injection in older Zabbix versions are standard exploitation steps.

## Phases

- [Enumeration](https://hackindex.io/services/zabbix/enumeration.md): Enumerate Zabbix frontend, test default creds, probe agent port (1 guides)
- [Exploitation](https://hackindex.io/services/zabbix/exploitation.md): RCE via agent system.run, API calls, and global scripts (1 guides)