Checkpoint Firewall Recon

Check Point Firewall-1 Reconnaissance

This skill provides techniques for enumerating Check Point Firewall-1 systems and assessing known vulnerabilities. Use these methods during authorized security assessments only.

When to Use This Skill

• Enumerating Check Point firewalls in a network
• Discovering firewall and management station hostnames
• Assessing HTTP Security Server format string vulnerabilities
• Port 264/TCP reconnaissance
• Security audits of Check Point infrastructure

Prerequisites

• Authorized access to target systems
• Network connectivity to target firewall
• Basic pentesting tools (nc, Metasploit optional)

Technique 1: Port 264 Hostname Discovery

Check Point Firewall-1 exposes the SecuRemote Topology service on port 264/TCP. This service can reveal the firewall hostname and SmartCenter management station name.

Method A: Metasploit Module

If Metasploit is available, use the built-in auxiliary module:

use auxiliary/gather/checkpoint_hostname
set RHOST <target_ip>
run

Expected output:

[*] Attempting to contact Checkpoint FW1 SecuRemote Topology service...
[+] Appears to be a CheckPoint Firewall...
[+] Firewall Host: <hostname>
[+] SmartCenter Host: <management_hostname>

Method B: Direct Socket Query

Send a raw query to port 264 and parse the response:

printf '\x51\x00\x00\x00\x00\x00\x00\x21\x00\x00\x00\x0bsecuremote\x00' | nc -q 1 <target_ip> 264 | grep -a CN | cut -c 2-

Expected output:

CN=<hostname>,O=<organization>

Script: Use scripts/checkpoint-264-discovery.sh for automated discovery.

Technique 2: HTTP Security Server Format String Vulnerability (CAN-2004-0039)

Affected Versions

• NG FCS, NG FP1, NG FP2, NG FP3 HF2
• NG with Application Intelligence R54/R55

Requirements

• HTTP Security Server or AI HTTP proxy must be enabled
• Transparent inspection of the targeted port
• If HTTP inspection is disabled, the vulnerability is not exploitable

Detection

Send a malformed HTTP request with format string specifiers. If the firewall (not backend) responds with reflected payload, the proxy is active:

printf 'BOGUS%%08x%%08x%%08x%%n HTTP/1.0\r\nHost: internal.local\r\n\r\n' | nc -nv <firewall_ip> 80

Indicators of vulnerability:

• Immediate response from firewall (not backend server)
• Response contains hex values or format string output
• Error page generated by proxy with attacker-controlled content

Script: Use scripts/checkpoint-http-format-string.sh for automated testing.

Exploitation Concepts

Format String Primitive

1. Force parser into error routine (invalid method/URI/headers)
2. Place attacker-controlled dwords at the start
3. Use %x/%s to leak pointers
4. Use %n/%hn to write formatted byte counts to chosen addresses
5. Overwrite return pointers, vtables, or heap metadata
6. Hijack execution with shellcode or ROP

Heap Overflow Primitive

The unsafe sprintf() writes to a fixed-size heap buffer:

1. Send long request body with oversized directives (e.g., %99999x)
2. Formatted output overruns allocation
3. Corrupt adjacent heap structures
4. Forge freelist pointers or function tables
5. Trigger dereference for code execution

Impact

Successful exploitation grants:

• Code execution in firewall process (SYSTEM on Windows, root on UNIX)
• Rule manipulation capabilities
• Traffic interception
• Pivot point into management network

Safety and Legal Considerations

• Only use on systems you own or have explicit authorization to test
• Document all findings for the authorized party
• Report vulnerabilities through proper channels
• This information is for defensive security and authorized assessments only

References

• Check Point SK69360
• CISA Alert 2004-02-05
• ISS X-Force Alert 162
• LFF-IPS-P2 Vulnerability Analysis