264 - Pentesting Check Point FireWall-1

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Inawezekana kuingiliana na CheckPoint Firewall-1 firewalls ili kugundua taarifa muhimu kama vile jina la firewall na jina la kituo cha usimamizi. Hii inaweza kufanywa kwa kutuma ombi kwa bandari 264/TCP.

Kupata Majina ya Firewall na Kituo cha Usimamizi

Kwa kutumia ombi la kabla ya uthibitisho, unaweza kutekeleza moduli inayolenga CheckPoint Firewall-1. Amri zinazohitajika kwa operesheni hii zimeelezwa hapa chini:

use auxiliary/gather/checkpoint_hostname
set RHOST 10.10.10.10

Upon execution, the module attempts to contact the firewall's SecuRemote Topology service. If successful, it confirms the presence of a CheckPoint Firewall and retrieves the names of both the firewall and the SmartCenter management host. Here's an example of what the output might look like:

Kwa utekelezaji, moduli inajaribu kuwasiliana na huduma ya SecuRemote Topology ya firewall. Ikiwa inafanikiwa, inathibitisha uwepo wa CheckPoint Firewall na inapata majina ya firewall na mwenyeji wa usimamizi wa SmartCenter. Hapa kuna mfano wa jinsi matokeo yanaweza kuonekana:

[*] Attempting to contact Checkpoint FW1 SecuRemote Topology service...
[+] Appears to be a CheckPoint Firewall...
[+] Firewall Host: FIREFIGHTER-SEC
[+] SmartCenter Host: FIREFIGHTER-MGMT.example.com
[*] Auxiliary module execution completed

Njia Mbadala ya Kugundua Jina la Kikoa na Jina la ICA

Mbinu nyingine inahusisha amri ya moja kwa moja inayotuma swali maalum kwa firewall na kuchambua jibu ili kupata jina la kikoa la firewall na jina la ICA. Amri na muundo wake ni kama ifuatavyo:

printf '\x51\x00\x00\x00\x00\x00\x00\x21\x00\x00\x00\x0bsecuremote\x00' | nc -q 1 10.10.10.10 264 | grep -a CN | cut -c 2-

Matokeo kutoka kwa amri hii yanatoa taarifa za kina kuhusu jina la cheti la firewall (CN) na shirika (O), kama inavyoonyeshwa hapa chini:

CN=Panama,O=MGMTT.srv.rxfrmi

References

• https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk69360

• https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html#check-point-firewall-1-topology-port-264

Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki hila za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.