#HITB2016AMS D2T1 - Attacking Next Generation Firewalls: Breaking PAN OS

### Overview This talk presents security research into PAN-OS, the proprietary software stack powering Palo Alto Networks next-generation firewalls (NGFW). Testing was primarily conducted on a physical Palo Alto PA-500 running PAN-OS 6.x on a 64-bit MIPS architecture (Cavium Octeon processor). The speaker examines the device's attack surface across three main operational areas: the restricted administrative management interface, the identity-mapping User-ID feature, and the GlobalProtect SSL VPN. The research demonstrates how attackers can progress from basic command injection to full unauthenticated remote root compromise.

### Key Topics - **PAN-OS Architecture & Jailbreaking:** Gaining shell access to the underlying Linux system by exploiting parameter escaping flaws in restricted administrative CLI commands. - **Management Web Interface Exploitation:** Identifying pre-authentication command execution vectors in the REST API interface. - **User-ID Mapping Flaws:** Weaknesses in user-to-IP mapping mechanisms, specifically default NetBIOS/WMI client probing, credential exposure, and spoofing risks. - **GlobalProtect SSL VPN Vulnerabilities:** Memory corruption vulnerabilities in native PHP extensions, denial-of-service via stack allocation, static master encryption keys, and arbitrary file creation leading to remote root privilege escalation.

### Technical Details - **CLI Jailbreak:** The restricted management CLI relies on wrappers around standard Linux tools. In the command `test scp server connection`, user-supplied hostnames were insufficiently escaped. By injecting the SSH/SCP proxy command option (`-o`), the researcher switched the session shell from the restricted interface to `/bin/bash`. - **Architectural Footprint:** PAN-OS runs on a Linux kernel with proprietary user-space daemons (`authd`, `cryptod`, `masterd`, `sysd`) and web interfaces powered by the Appweb server using native C/C++ PHP extensions on a MIPS64 processor. - **Management REST API Command Injection:** Requesting `/api` with `client=wget` invokes a pre-authentication native function (`api_wget_filter_func`) that calls `curl` locally via user inputs (`key`, `HTTP_AUTH`, `X-Real-IP`). While `escapeshellarg` was applied to inputs, the application omitted error checking when escaping `X-Real-IP`. Supplying an oversized buffer caused truncation without the closing single quote, producing an off-by-one quoting error that allowed arbitrary command execution as user `nobody`. - **User-ID Spoofing:** To map active directory usernames to IP addresses, PAN-OS enables client probing by default over NetBIOS/WMI. An attacker receiving a probe can return arbitrary usernames (e.g., using Impacket) to forge mappings into the firewall's active user database. - **GlobalProtect Remote Code Execution:** - The SSL VPN uses `escape_string_for_xml` on input usernames into a fixed-size 1024-byte stack buffer. Input validation via `ssl_vpn_field_filter_check_user` enforces length checks for ASCII strings, but a logic flaw in `is_valid_utf8` bypasses length and character restrictions if the string consists entirely of multi-byte UTF-8 characters (e.g., characters like 'ä'). - Exploitation on MIPS64 faced constraints: big-endian byte order, a hybrid 32-bit address space with 64-bit registers, and MIPS Execute-Inhibit (NX/DEP) preventing shellcode execution on the heap. Overwriting the 64-bit return address register directly was impossible with alphanumeric bytes because the upper half required null bytes. - Instead, the exploit targets a stack-allocated PHP context pointer invoked during `php_body_write`. Exploiting Appweb's HTTP keep-alive behavior, the researcher sprayed the heap up to 1 MB per socket to allocate controlled structures at predictable alphanumeric addresses. - Because the Appweb binary was small with only 10 fixed functions, a full ROP chain to an arbitrary shell was not directly available. The researcher constructed a targeted ROP gadget calling `ma_start_logging` to create an arbitrary file on disk. A local cron script executing a compression routine with a command injection flaw then triggered the payload, escalating privileges to a root shell.

### Takeaways All demonstrated vulnerabilities were reported to and addressed by Palo Alto Networks. Administrators are advised to strictly isolate management interfaces, avoid using User-ID for security-critical administrative access controls, disable client probing, isolate User-ID agents, update default device master keys to secure encrypted session cookies, and apply regular vendor updates. As appliances add advanced inspection and management features, their proprietary native code footprint expands, increasing potential attack surface.