CVE-2021-25281

This repository contains a functional exploit for CVE-2021-25281, which leverages directory traversal in SaltStack's file writing functionality to achieve arbitrary file write and potential remote code execution. The exploit includes multiple modes for writing files, creating state files for command execution, and injecting SSH keys.

This Metasploit module exploits an authentication bypass (CVE-2021-25281) and directory traversal (CVE-2021-25282) in SaltStack Salt's REST API to achieve unauthenticated remote code execution as root. It leverages the maintenance process check to execute a malicious Python script placed in the Extension Module directory.