Check to see if your Palo Alto firewall has been compromised by running script againt support bundle. # Palo Vulnerability Check - CVE-2024-3400
## Overview
This script is designed to check for signs of compromise in Palo systems, specifically for the vulnerability identified as CVE-2024-3400. It searches through tech support package `gz` or .tgz archive files for specific log entries that may indicate a security breach.
## Prerequisites
- Python 3.x
- Access to the `.tar.gz` file containing Palo logs.
## Usage
1. Ensure you have a `.tar.gz` tech supprot file containing the relevant Palo logs.
2. Modify the `filepath` variable in the script to point to your `.tar.gz` file.
4. Optional - Update the `search_terms` list with the terms that are indicative of the CVE-2024-3400 vulnerability.
5. Run the script in a Python environment.
## How It Works
- The script will decompress the `.tar.gz` file and search through the specified log files.
- If it finds any of the search terms, it will print the matching lines and advise you to follow remediation guidance and share the files with the vendor.
- If no matches are found, it will print a message indicating that no compromise was detected, but still recommend sharing the file with the vendor for certainty.
## Example
```python
# Replace this with your actual file path
filepath = r'path to techsupport.tgz'
```
## Important Notes
- The script stops searching after finding the first set of matches. If you need a full search, remove the `return` statement after printing matches.
- The script is a basic tool for initial checks and does not replace professional forensic analysis.
- Always ensure you have the latest updates and patches applied to your Palo systems to prevent vulnerabilities like CVE-2024-3400.
## Contributing
If you have suggestions for improving this script or have found a bug, please open an issue or a pull request with your changes.
[4.0K] /data/pocs/86f46a90146d79ba80bb8aa81987dc04faeb2606
├── [1.8K] main.py
└── [1.8K] README.md
0 directories, 2 files