CVE-2017-15944

This Metasploit module exploits a chain of vulnerabilities in Palo Alto Networks PAN-OS, including authentication bypass, XML injection, and cron job manipulation, to achieve root code execution. It stages a reverse TLS callback to deliver the payload, with execution triggered by a cron job running every 15 minutes.

This is a detailed writeup describing three separate bugs in Palo Alto Networks firewalls that can be chained to achieve unauthenticated remote root code execution. The bugs include an authentication bypass, arbitrary directory creation, and a command injection in a cron script.

This repository contains a detection script and an exploit for CVE-2017-15944, a remote code execution vulnerability in Palo Alto Networks PAN-OS. The exploit leverages a command injection flaw in the `cms_changeDeviceContext.esp` endpoint to create a session and verify vulnerability via a debug console.

This PoC checks for CVE-2017-15944, a remote code execution vulnerability in Palo Alto Networks firewalls. It attempts to exploit a session manipulation flaw to verify if the target is vulnerable by checking for a debug console response.

This repository contains a README file describing CVE-2017-15944, a vulnerability affecting Palo Alto PAN-OS versions up to 6.1.18, 7.0.18, 7.1.14, and 8.0.5. No exploit code or technical details are provided.

This repository contains a working exploit for CVE-2017-15944, targeting a vulnerability in Palo Alto Networks PAN-OS. The exploit leverages a command injection flaw to achieve remote code execution (RCE) via a reverse shell.

This repository contains a functional exploit for CVE-2017-15944, targeting Palo Alto Networks PAN-OS. The exploit leverages a command injection vulnerability to achieve remote code execution (RCE) via a reverse shell.

This Metasploit module exploits a chain of vulnerabilities in Palo Alto Networks PAN-OS, including authentication bypass, XML injection, and cron job manipulation, to achieve root code execution. It stages a reverse TLS callback to deliver the payload, with execution triggered by a cron job running every 15 minutes.