264 - Pentesting Check Point FireWall-1
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
It's possible to interact with CheckPoint Firewall-1 firewalls to discover valuable information such as the firewall's name and the management station's name. This can be done by sending a query to the port 264/TCP.
Using a pre-authentication request, you can execute a module that targets the CheckPoint Firewall-1. The necessary commands for this operation are outlined below:
Upon execution, the module attempts to contact the firewall's SecuRemote Topology service. If successful, it confirms the presence of a CheckPoint Firewall and retrieves the names of both the firewall and the SmartCenter management host. Here's an example of what the output might look like:
Another technique involves a direct command that sends a specific query to the firewall and parses the response to extract the firewall's hostname and ICA name. The command and its structure are as follows:
The output from this command provides detailed information regarding the firewall's certificate name (CN) and organization (O), as demonstrated below:
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
