CyberDefense-Lab

Cyber Security Lab: Blue Team Infrastructure & Network Defense This laboratory project demonstrates the creation of an integrated "Blue Team" infrastructure, focusing on centralized network security, Intrusion Detection/Prevention Systems IDS/IPS, and Security Information and Event Management SIE...

CVE-2019-12949

CVE-2019-12949 From Cross Site Scripting Vulnerability to Remote Code Execution in pfSense 2.4.4-p2 and 2.4.4-p3 Information Description: In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trich the authenticated administrator into clicking on a button on a phishing page, an attacker can uplo...

pfsense-ipsec-login-banner

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ipsec-login-banner pfsense-ipsec-login-banner Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org IPsec Mobile login banner is stored with a length check only, then dumped unquoted into...

Penetration-Testing-Walkthrough-Hacksudo-Thor

HackSudo Thor Full Penetration Testing Walkthrough Target: HackSudo Thor from VulnHub Objective: Gain root access and read /root/proof.txt Environment: Isolated VirtualBox lab segmented by a pfSense firewall Table of Contents Overview Network Topology Attack Chain Summary Phase 1: Passive...

dod-blue-team-network-lab

DoD Blue Team Network Security & Hardening Lab Executive Summary High fidelity defensive security lab simulating a DoD aligned enterprise network. This project demonstrates structured network segmentation, system hardening, centralized telemetry ingestion, detection engineering, adversary...

pfsense-qinq-parent-if

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-qinq-parent-if pfsense-qinq-parent-if Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org QinQ edit stores a parent interface name with no doesinterfaceexist check. VLAN edit already...

pfsense-carp-vhid

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-carp-vhid pfsense-carp-vhid Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Virtual IP edit stores CARP VHID from POST with no 1-255 check. FormSelect options are HTML only. CARP...

pfsense

pfSense Overview The pfSense project is a free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party free software packages for additional functionality. pfSense software, with the help of the package system, is able to provide the sam...

pfsense-limiter-number

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-limiter-number pfsense-limiter-number Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Traffic Shaper Limiters emit a hidden number field on edit. Create overwrites that number with...

pfsense-cp-maxprocperip

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-cp-maxprocperip pfsense-cp-maxprocperip Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Integer check is on unused POST maxproc. maxprocperip is stored raw and emitted ...

SenselessViolence

SenselessViolence CVE-2022-31814 pfSense pfBlockerNG = 2.1.426 Exploitation Toolkit. What? This is an exploitation toolkit for the pfSense pfBlockerNG = 2.1.426 plugins remote command injection feature discovered by IHTeam. I wrote this to play around with some of the design principles found in t...

pfsense-igmp-type

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-igmp-type pfsense-igmp-type Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org servicesigmpproxyedit.php stores POST type with no enum check. configure interpolates phyint...

CVE-2023-27100

CVE-2023-27100 - pfSense Anti-brute force protection bypass Problem Description The authentication system attempts to be informative and print extra information along with IP addresses to completely identify where a user logs in from when they login using the GUI. This includes the authentication...

pfsense-cp-ha-pfctl

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-cp-ha-pfctl pfsense-cp-ha-pfctl Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org captiveportalloadpfctl runs mwexec"/usr/bin/printf "$rules" | /sbin/pfctl -a $anchor/$host -f-" with...

Red-Team-GOAD-Lab-Proxmox

Red-Team-GOAD-Lab-Proxmox Infrastructure diagram Build in order: pfSense VLANs and firewall policy. Operator and Redirector VMs. GOAD lab setup in Proxmox. Verification, snapshots and troubleshooting. Command syntax for Packer, Terraform and GOAD should be checked against your freshly cloned GOAD...

CVE-2024-46538

Thanks tophysicszq, who discovered this vulnerability. CVE-2024-46538 ★ CVE-2024-46538 PfSense Stored XSS lead to Arbitrary Code Execution PoC ★ Description CVE-2024-46538 : PfSense Stored XSS Vulnerability description: A cross-site scripting XSS vulnerability in pfsense v2.5.2 allows attackers t...

pfsense-crash-reporter-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-crash-reporter-xss pfsense-crash-reporter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org /tmp/PHPerrors.log goes through htmlspecialchars. /var/crash/ is filegetcontents into...

CVE-2024-46538

This post is a research article published by EQSTLab. Thanks tophysicszq, who discovered this vulnerability. CVE-2024-46538 ★ CVE-2024-46538 PfSense Stored XSS lead to Arbitrary Code Execution PoC ★ https://github.com/user-attachments/assets/f41d0945-b7f4-4f88-bac5-265904256aae Description...

Security_incident_report

01. Infrastructure Configuration The infrastructure for this project is not managed with IaC e.g., Terraform code; instead, it was built by installing pfSense and Wazuh and then changing settings directly from the admin GUI. So instead of "code", this document records the network diagram,...

pfsense-ovpn-learn-cn

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ovpn-learn-cn pfsense-ovpn-learn-cn Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org openvpn.learn-address.sh interpolates CN into su -m unbound -c "... localdata $CN.$DOMAIN ..."...