Privilege Escalation in Palo Alto Networks PAN-OS Management Web Interface

This repository is a small standalone exploit PoC with two files: a README describing the PAN-OS vulnerability chain and a single Python entry-point script, exploit.py. The script targets Palo Alto Networks PAN-OS management interfaces over HTTPS and chains CVE-2024-0012 (authentication bypass) with CVE-2024-9474 (privilege escalation via PHP session path traversal) to achieve unauthenticated root-level RCE. Repository structure is minimal and purpose-built: README.md documents affected versions, exploitation logic, and mitigation guidance; exploit.py implements the attack flow. The Python code uses requests, disables TLS warnings for self-signed certificates, parses CLI arguments, and executes in two stages. Stage 1 iterates through a hardcoded list of candidate REST API paths such as /php/../restapi/10.2/ and /restapi/10.2/ to obtain an authenticated session context by probing for successful HTTP responses or redirects. Stage 2 builds a PHP payload of the form <?php system("<command>"); ?>, then abuses the session handler endpoint /php/utils/session_handler.php by supplying a traversal-based session identifier like ../../php/shell_xxxxxx.php, intending to write the payload into a web-accessible PHP location. The exploit’s main capability is arbitrary command execution as root via an uploaded PHP webshell. It supports a user-supplied command, optional custom shell filename, configurable target/port, optional SSL verification disablement, and an optional interactive shell mode after successful upload. Based on the available code and README, this is a real exploit rather than a detector, and it is best classified as OPERATIONAL: it contains a working hardcoded payload and end-to-end exploitation logic, but it is not part of a larger exploitation framework.

This repository contains a single main exploit tool, PanOsExploitMultitool.py, written in Python. The tool targets Palo Alto Networks PAN-OS devices vulnerable to CVE-2024-0012 and CVE-2024-9474, providing exploitation and post-exploitation capabilities. The script supports several commands: - 'check': Tests if a target is vulnerable. - 'shell': Exploits the target to obtain a reverse shell by chunking and writing a base64-encoded bash shell payload to a writable directory, then executing it to connect back to the attacker's listener. - 'dump': Retrieves and decrypts credentials from the target's configuration files using a known AES master key, and can also extract the full running configuration. - 'local': Decrypts credentials from a local XML config file, useful for offline analysis. - 'decrypt': Interactively decrypts encrypted credential strings using the public master key. The tool interacts with the PAN-OS management interface over HTTPS (default port 443), and uses file paths such as /var/tmp/ and /opt/pancfg/mgmt/saved-configs/ on the target device. It is operational and provides real exploitation and credential extraction capabilities, not just detection. The repository includes a README with detailed usage instructions and references, a requirements.txt for dependencies, and an Apache 2.0 license.

This repository contains a single Metasploit module (panos_management_unauth_rce.rb) that exploits two vulnerabilities (CVE-2024-0012 and CVE-2024-9474) in the Palo Alto Networks PAN-OS management web interface. The exploit leverages an authentication bypass and a command injection to achieve unauthenticated remote code execution as root on affected PAN-OS versions (10.2, 11.0, 11.1, 11.2 up to specified patch levels). The module is highly weaponized, supporting arbitrary command or shell payloads (including Meterpreter and reverse shells), which are delivered in chunks due to command length restrictions. The exploit interacts with specific web endpoints (notably /php/utils/createRemoteAppwebSession.php and /index.php/.js.map) and writes payloads to writable directories on the target. The code is structured as a standard Metasploit exploit module, with clear separation of check and exploit routines, and is intended for use within the Metasploit framework.

This repository is a Go-based Proof of Concept (PoC) exploit for two vulnerabilities in Palo Alto PAN-OS: CVE-2024-0012 and CVE-2024-9474. The main exploit logic resides in 'main.go', which provides two modes: scan mode and exploit mode. In scan mode, the tool checks a list of target URLs for unauthenticated access to a specific endpoint, indicating vulnerability. In exploit mode, it provides an interactive shell for the user to execute arbitrary commands on a single vulnerable target. The exploit works by sending a specially crafted POST request to '/php/utils/createRemoteAppwebSession.php/peppa.js.map' with a payload that writes the output of a shell command to a web-accessible file, which is then retrieved by the tool. The repository includes a README with detailed usage instructions, a Go module definition, and a single Go source file implementing the exploit. The exploit targets network-accessible PAN-OS devices and leverages unauthenticated HTTP endpoints to achieve command execution.

This repository contains a Python proof-of-concept exploit for CVE-2024-0012 (authentication bypass) and CVE-2024-9474 (command execution) affecting Palo Alto Networks PAN-OS. The main file, 'CVE-2024-0012_CVE-2024-9474_Exploit_Palo_Alto_PAN-OS_PoC.py', automates the exploitation process: it first checks if the target is vulnerable, extracts a PHP session ID, generates a double-base64-encoded bash reverse shell payload, and uploads it in chunks to the target using a vulnerable PHP endpoint. The script then reconstructs and decodes the payload on the target, writes it to a shell script, and executes it, resulting in a reverse shell connection to the attacker's listener. The exploit leverages specific HTTP endpoints on the target PAN-OS device and uses temporary files for payload assembly. The repository also includes a detailed README with usage instructions, vulnerability descriptions, and references. The exploit is operational and provides a working reverse shell if the target is vulnerable and properly configured.

This repository contains a Python exploit script (exploit_fw.py) targeting Palo Alto Networks PAN-OS devices vulnerable to CVE-2024-0012 and CVE-2024-9474. The exploit abuses a vulnerable PHP endpoint to inject a shell command (up to 19 characters) via a POST request, which writes the command output to a PHP file in a web-accessible directory on the target device. The script then retrieves the output by making a GET request to the created PHP file. The exploit requires the attacker to specify the target hostname and the command to execute. The README provides references to a blog post and social media for further context. The repository is structured simply, with one main exploit script and a README. The exploit is operational and demonstrates remote command execution, potentially allowing for further exploitation such as reverse shells.

This repository is a Go-based exploit tool targeting Palo Alto Networks PAN-OS, specifically for CVE-2024-9474 (and possibly CVE-2024-0012). The tool provides two main modes: a scan mode for batch testing multiple targets for authentication bypass, and an exploit mode that offers an interactive shell-like interface to execute arbitrary commands on a single target. The exploit works by sending a crafted POST request to a vulnerable endpoint, causing the target to execute arbitrary shell commands and write their output to a web-accessible file, which the tool then retrieves. The code is well-structured, with clear separation between scanning and exploitation logic, and uses several third-party Go libraries for argument parsing, progress bars, and colored output. The main entry point is 'main.go'. The tool is operational and provides real exploitation capabilities, not just detection. No hardcoded IPs or domains are present; the user supplies targets via command-line arguments or a file.