Researchers Trace PHP2Shell PAN-OS Exploitation From Reconnaissance to Enterprise Access
Summary
Hunt.io researchers analyzed an exposed toolkit documenting PAN-OS exploitation, reporting 19,182 scanned management portals and logs indicating 25 root compromises. They detail the exploit chain, persistence, lateral movement, and AI-assisted tooling.
Key points
- An exposed directory contained exploitation scripts, scan results, and logs. The researchers report that 25 PAN-OS appliances reached root access, based on command output in the logs.
- The toolkit chained unauthenticated PHP session.upload_progress memory corruption with Fragnesia (CVE-2026-46300) to gain root through the management interface.
- The operator scanned 19,182 management portals, identified 631 running firmware the toolkit supported, and selected 240 targets for exploitation.
- Persistence scripts installed a systemd service and an rc.local hook, while reverse SSH tunnels and a SOCKS5 proxy enabled access to internal services and networks.
- The researchers found evidence of Active Directory and Keycloak reconnaissance, credential spraying, configuration extraction, and pivots to a Panorama server and managed firewall.
- A separate tool targeted GlobalProtect authentication override cookies using CVE-2026-0257.
- Session logs show an AI platform reading offensive playbooks, downloading 17 tools, and checking their availability; the researchers found no evidence that Claude Code was used in the attack.
Article Details
- Attack Vectors
- An unauthenticated HTTP request to the PAN-OS management interface triggers PHP session.upload_progress heap corruption, leaks a libphp address, and executes a shell command.
- The exploit chain uses Fragnesia (CVE-2026-46300) to escalate from the nobody account to root, including by changing the PAM configuration to allow passwordless su.
- A separate tool forges GlobalProtect authentication-override cookies using the public key extracted from the gateway's TLS certificate.
- The operator installed a root command relay and reboot-persistent access using a systemd service and an rc.local hook, then established reverse SSH tunnels and a SOCKS5 proxy.
- Post-compromise activity included internal network scanning, Active Directory and configuration reconnaissance, password spraying, credential and key extraction, and pivoting to additional firewall infrastructure.
- Defensive Notes
- Restrict PAN-OS management interfaces to dedicated management networks or authorized administrator IP addresses; do not expose them directly to the internet.
- Apply relevant PAN-OS security updates and hotfixes promptly, including patches for vulnerabilities exploited in the campaign.
- Audit for unauthorized systemd services, rc.local changes, SSH keys, PAM modifications, altered PHP files, and suspicious files in /usr/local/lib/.panops/ and /dev/shm/.
- Monitor firewall egress for unusual SSH connections, reverse tunnels, and SOCKS5 proxy activity, including on port 10700.
- Segment firewall access to internal systems, especially domain controllers and VPN infrastructure; rotate stored LDAP credentials and shared SSH keys.
- Harden GlobalProtect and SSO by patching authentication vulnerabilities, enforcing MFA, reviewing SAML trust relationships, and monitoring VPN logins.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 130[.]94[.]67[.]235 | Operator VPS hosting the exposed exploitation toolkit and receiving reverse SSH tunnels from compromised firewalls. |
MITRE ATT&CK
T1021.004 · SSHThe operator attempted SSH access to internal hosts using harvested keys and credential lists through reverse-tunnel ports.T1037.004 · RC ScriptsThe installer added a PANOPSHELL-marked command hook to rc.local for boot persistence.T1046 · Network Service DiscoveryScripts scanned internal subnets and domain-controller ports from compromised firewalls.T1059.004 · Unix ShellShell commands were executed through the root-capable change_password.php relay.T1068 · Exploitation for Privilege EscalationThe Fragnesia kernel exploit was used to escalate from nobody to root on PAN-OS appliances.T1087.002 · Domain Accountadacl.py queried LDAP for domain users, groups, memberships, computer objects, and ACLs.T1090.001 · Internal ProxyA SOCKS5 proxy on the compromised firewall provided the operator access to the internal network.T1105 · Ingress Tool TransferThe operator served tools from the VPS and transferred files to compromised hosts in base64-encoded POST chunks.T1110.003 · Password SprayingThe operator's scripts attempted password spraying against LDAP and Keycloak authentication endpoints.T1190 · Exploit Public-Facing ApplicationThe operator exploited PHP session.upload_progress heap corruption through the exposed PAN-OS management interface.T1505.003 · Web ShellThe operator replaced change_password.php with a root-capable command relay.T1543.002 · Systemd ServiceThe persistence installer created and enabled the pan-ops-init.service systemd unit.T1552.001 · Credentials In FilesThe operator extracted LDAP credentials and SSH keys from PAN-OS configuration files.T1572 · Protocol TunnelingPersistent reverse SSH tunnels mapped internal network services to ports on the operator's VPS.T1606.001 · Web Cookiesforge_cookie.py forged GlobalProtect authentication-override cookies to bypass authentication.
CVE
CVE-2026-0257Palo Alto Networks · PAN-OS; Palo Alto Networks · Prisma Access; +1 moreinfrastructure, SOCKS5 proxy pivots, AD/LDAP reconnaissance, GlobalProtect authentication bypass (CVE-2026-0257), and automated persistence and recovery scripts.CVE-2026-109618Vendor / Product unavailableour previous research, Hunting Leaked PHP2Shell RCE Across Open Directories examined the exposure of CVE-2026-109618 and CVE-2026-109619, uncovering attacker tooling and early exploitation attempts. We followed up inCVE-2026-109619Vendor / Product unavailableHunting Leaked PHP2Shell RCE Across Open Directories examined the exposure of CVE-2026-109618 and CVE-2026-109619, uncovering attacker tooling and early exploitation attempts. We followed up in PHP2Shell One WeekCVE-2026-46300Linux · Linux; Red Hat · NVIDIA for RHEL 10; +28 moreHTTP request, combining PHP session.upload_progress memory corruption with the Fragnesia kernel LPE (CVE-2026-46300).
Vendors
Products
DeepSeek v4-proThe operator deployed a multi-agent AI penetration testing platform (aiscan) powered by DeepSeek v4-pro, DeepSeek v4-flash, and Kimi k3.GlobalProtectmanaged firewall infrastructure, and a deep post-exploitation playbook targeting Active Directory, GlobalProtect VPN, and Keycloak SSO infrastructure.Keycloakinfrastructure, and a deep post-exploitation playbook targeting Active Directory, GlobalProtect VPN, and Keycloak SSO infrastructure.Microsoft Active Directoryto Panorama and managed firewall infrastructure, and a deep post-exploitation playbook targeting Active Directory, GlobalProtect VPN, and Keycloak SSO infrastructure.PAN-OSplatform identified an open directory at 130.94.67[.]235:8080 containing a fully operational PAN-OS exploitation toolkit. The analysis reveals an entire campaign lifecycle including internet-widePanorama25 confirmed root compromises across major US and South Korean organizations including lateral pivots to Panorama and managed firewall infrastructure, and a deep post-exploitation playbook targeting Active Directory,
Tools
adacl.pyThe directory contains multiple AD reconnaissance scripts of increasing sophistication. The primary tool (adacl.py) performs LDAP-based enumeration of the target domain, querying for users, groups, group memberships,aiscanThe operator deployed a multi-agent AI penetration testing platform (aiscan) powered by DeepSeek v4-pro, DeepSeek v4-flash, and Kimi k3.exfil.pyexfil.py performs a comprehensive extraction of pivot-enabling material from the running configuration: HA SSH private keys (PAN-OS roots high-availability over SSH), device certificates with encrypted passphrases, LDAPforge_cookie.pyBeyond the PAN-OS exploitation chain, the open directory contains forge_cookie.py, a standalone tool that exploits CVE-2026-0257 to forge GlobalProtect authentication override cookies. The tool requires no credentialspanos_rce_poc.pyhandler as exposed through PAN-OS's management web interface. The core exploit logic resides in panos_rce_poc.py, which orchestrates the entire four-stage chain from a single invocation.pfrag.pypage-cache handling. This stage is implemented by two dedicated payloads in the open directory. The pfrag.py contains the Fragnesia kernel exploit variant and webshell dropper, and the fpatch.py handles the PAMscan.pyThe script scan.py implements a multithreaded TCP port scanner designed to run from the compromised appliance using only Python standard library modules. It targets internal subnets with a curated list of 36 portssocks.pyThe SOCKS5 proxy itself (socks.py) is a minimal, threaded implementation supporting CONNECT operations only, designed to be started with setsid so it survives the PHP relay request that launches it. A supervisor scripttun.shbridge between the compromised firewall's internal network and the operator's VPS. The script tun.sh establishes persistent reverse SSH tunnels that map eight internal network services to localhost ports onvssh.pyThe script vssh.py implements targeted SSH authentication attempts against internal hosts reached through the reverse tunnel. The script uses the Paramiko library to attempt connections with harvested SSH keys and a
Countries
ChinaFrom the 631 exploitable hosts, the operator further filtered to a batch of 240 targets concentrated in four countries: the United States (219), China (9), South Korea (6), and Japan (6).JapanFrom the 631 exploitable hosts, the operator further filtered to a batch of 240 targets concentrated in four countries: the United States (219), China (9), South Korea (6), and Japan (6).South KoreaThe exploitation logs across document root access on 25 appliances (18 US, 6 South Korea, 1 internal pivot), including lateral movement to a Panorama management server and a managed next-generation firewall within theUnited StatesFigure 7. Country distribution of 19,182 PAN-OS management interfaces discovered via FOFA reconnaissance. The United States dominates with nearly 25% of all exposed portals.Phase 2: Version Fingerprinting