Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-3400-POC — Python script to test for CVE-2024-3400 RCE in Palo Alto GlobalProtect by sending crafted cookies with base64-encoded commands and analyzing responses. | Kitploit
Tools/GitHubGitHub/conditionblack/cve-2024-3400-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubconditionblack/cve-2024-3400-poc

CVE-2024-3400-POC

Python script to test for CVE-2024-3400 RCE in Palo Alto GlobalProtect by sending crafted cookies with base64-encoded commands and analyzing responses.

View Repository
22 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-3400 RCE Test Script

Overview

This Python script is designed to test for a remote code execution (RCE) vulnerability, specifically CVE-2024-3400, which affects certain Palo Alto Networks GlobalProtect portals. The vulnerability allows unauthorized command execution via cookie manipulation.

The script sends a benign HTTP GET request to a list of specified URLs with a cookie payload that includes a base64-encoded command (echo test). If the command executes, it indicates potential vulnerability.

How It Works

Components

  • Base64 Encoding: Commands are encoded in base64 to simulate how an attacker might obscure malicious commands to bypass basic security filters.
  • HTTP Requests: The script uses the requests Python library to send HTTP GET requests with the malicious cookie.
  • File Handling: It reads a list of target URLs from an input file and writes the test results to an output file.

Steps

  1. Command Encoding: The echo test command is encoded into base64.
  • Cookie Crafting: A cookie payload is crafted with the encoded command inserted in a way that would be executed if the system is vulnerable.
  • Request Sending: For each URL, the script sends an HTTP request with the crafted cookie.
  • Response Analysis: The script checks the HTTP response to see if the test command's output appears, indicating command execution.
  • Result Logging: Results are logged to an output file, noting whether each URL is potentially vulnerable.

    • Usage

    Run the script from the command line by providing the input file (containing URLs to test) and the output file (to store results):

    root@kitploit:~
    python script_name.py input_file.txt output_file.txt

    Replace script_name.py with your script's filename, input_file.txt with your input file, and output_file.txt with your desired output file.

    Dependencies

    • Python 3.x
    • requests library (install via pip install requests)

    Articles and References

    • Watchtowr Labs Analysis on CVE-2024-3400 This article provides an in-depth look at the CVE-2024-3400 vulnerability, detailing how it can be exploited and its potential impact.

    • LinkedIn Post by Justin Elze Justin Elze discusses the significance of the CVE-2024-3400 discovery and its implications for security in enterprise environments.

    Disclaimer

    This script is for educational and testing purposes only. Use it responsibly. Executing this script without authorization on systems you do not own or have permission to test is unethical and illegal. Always ensure compliance with all applicable laws and regulations.

    Download Tool