ZooKeeper

Default Ports: 2181 (Client), 2888/3888 (Cluster)

Apache ZooKeeper stores coordination data for distributed systems such as Kafka, Hadoop, Solr, and service discovery platforms. In pentests, open ZooKeeper can leak znodes, service metadata, configs, credentials, and cluster topology.

Connect​

Using nc​

ZooKeeper supports four-letter commands for quick checks.

echo ruok | nc target.com 2181  
echo stat | nc target.com 2181  
echo conf | nc target.com 2181  
echo srvr | nc target.com 2181  

Using zkCli​

zkCli.sh is the standard interactive client.

zkCli.sh -server target.com:2181  
ls /  
get /zookeeper/config  

Using zookeeper-shell​

Kafka distributions often include zookeeper-shell.

zookeeper-shell target.com:2181  
ls /  
get /brokers/ids  

Recon​

Service Detection with Nmap​

Scan client and quorum ports.

nmap -p 2181,2888,3888 -sV target.com  
nmap -p 2181 --script zookeeper-info target.com  
nmap -p 2181 --open -sV 10.0.0.0/24  

Four-Letter Command Review​

Four-letter commands reveal health, configuration, sessions, and server state.

for cmd in ruok stat conf srvr mntr envi; do echo $cmd | nc target.com 2181; done  

Product Context​

ZooKeeper often supports Kafka, Solr, Hadoop, or HBase.

echo dump | nc target.com 2181  
echo cons | nc target.com 2181  

Enumeration​

Znode Enumeration​

List znodes to map applications and service metadata.

zkCli.sh -server target.com:2181  
ls /  
ls /brokers  
ls /config  

Kafka Metadata​

Kafka deployments store broker and topic metadata in ZooKeeper.

zookeeper-shell target.com:2181 ls /brokers/ids  
zookeeper-shell target.com:2181 get /brokers/ids/0  
zookeeper-shell target.com:2181 ls /brokers/topics  

ACL Enumeration​

Weak or open ACLs allow reading or modifying znodes.

zkCli.sh -server target.com:2181  
getAcl /  
getAcl /brokers  

Config Enumeration​

Config znodes may expose endpoints, credentials, or service names.

zkCli.sh -server target.com:2181  
ls /config  
get /config/application  

Attack Vectors​

Unauthenticated Access​

Open client access may expose all znodes.

zkCli.sh -server target.com:2181  
ls /  
get /some/znode  

Sensitive Znode Data​

Search exported znode data for secrets.

grep -Ei 'password|secret|token|apikey|jdbc|ldap|kafka|broker' zookeeper-dump.txt  

Znode Modification​

Write access can disrupt dependent services.

zkCli.sh -server target.com:2181  
create /pentest-test "authorized-test"  
delete /pentest-test  

Unsafe Four-Letter Commands​

Some commands expose sessions and environment details.

echo envi | nc target.com 2181  
echo cons | nc target.com 2181  
echo dump | nc target.com 2181  

Post-Exploitation​

Cluster Mapping​

Use ZooKeeper data to map brokers, services, and hosts.

echo conf | nc target.com 2181 > zookeeper-conf.txt  
zookeeper-shell target.com:2181 ls /brokers/ids > kafka-brokers.txt  

Secret Review​

Review only exported metadata needed for proof.

grep -Ei 'password|secret|token|apikey|connection|jdbc|sasl' zookeeper-dump.txt  

Evidence Collection​

Collect health, config, ACL, and sample znode evidence.

echo stat | nc target.com 2181 > zookeeper-stat.txt  
echo conf | nc target.com 2181 > zookeeper-conf.txt  

Useful Tools​

Tool| Purpose
---|---
nc| Four-letter commands
zkCli.sh| Native client
zookeeper-shell| Kafka ZooKeeper client
nmap| Service detection
grep| Secret review

Security Misconfigurations​

Misconfiguration| Risk
---|---
Unauthenticated client access| Znode data disclosure
Weak ACLs| Znode modification
Four-letter commands exposed| Cluster metadata leakage
ZooKeeper reachable from user networks| Service discovery exposure
Secrets stored in znodes| Credential leakage
Quorum ports exposed broadly| Cluster attack surface