HackTricks
Searchโ€ฆ
๐Ÿ‘ฝ
Network Services Pentesting
264 - Pentesting Check Point FireWall-1
Support HackTricks and get benefits!
Module sends a query to the port 264/TCP on CheckPoint Firewall-1 firewalls to obtain the firewall name and management station (such as SmartCenter) name via a pre-authentication request
1
use auxiliary/gather/checkpoint_hostname
2
set RHOST 10.10.xx.xx
Copied!
Sample Output
1
[*] Attempting to contact Checkpoint FW1 SecuRemote Topology service...
2
[+] Appears to be a CheckPoint Firewall...
3
[+] Firewall Host: FIREFIGHTER-SEC
4
[+] SmartCenter Host: FIREFIGHTER-MGMT.example.com
5
[*] Auxiliary module execution completed
Copied!
Another way to obtain the firewall's hostname and ICA name could be
1
printf '\x51\x00\x00\x00\x00\x00\x00\x21\x00\x00\x00\x0bsecuremote\x00' | nc -q 1 x.x.x.x 264 | grep -a CN | cut -c 2-
Copied!
Sample Output
1
CN=Panama,O=MGMTT.srv.rxfrmi
Copied!
Support HackTricks and get benefits!
Copy link