Zabbix is a widely deployed monitoring platform with several components: a PHP web frontend (usually at /zabbix/), a JSON-RPC API (/api_jsonrpc.php), the Zabbix server (trapper on TCP 10051), and Zabbix agents on monitored hosts (TCP 10050). It is a high-value target for two reasons: it stores credentials to reach the systems it monitors (SNMP strings, SSH and IPMI logins, database and API secrets in item and macro configuration), and it executes commands on hosts as a core feature (items, scripts, remote commands). The attack surface follows: enumerating the environment through the API and UI, gaining access through default and weak credentials or stolen sessions, reaching code execution through items, global/alert scripts, the agent, and SQL injection, and abusing configuration and exposure.
# fingerprint and reach the components
curl -sk https://<target>/zabbix/ | grep -i zabbix
curl -sk https://<target>/zabbix/api_jsonrpc.php -H 'Content-Type: application/json-rpc' \
-d '{"jsonrpc":"2.0","method":"apiinfo.version","params":{},"id":1}' # version, no auth
nmap -p10050,10051 -sV <target> # agent and server
Subtopics#
- Enumeration: version, API, users, and monitored hosts.
- Authentication: defaults, weak passwords, guest, API bypass, session theft.
- Code execution: items, scripts, the agent, SQLi, and known exploits.
- Configuration and exposure: exposed interface and roles.