Remote Full Compromise Exploit Chain

The talk presents research on the Palo Alto GlobalProtect client, looking only at the endpoint software rather than the server. The speaker, from a red team, first outlines how the client is split between a user interface, a background service, and a portal and gateway that handle configuration and authentication. The attack starts on a rogue access point, where the client accepts DNS settings from the network, and then exploits weak certificate checks to install an attacker-controlled certificate authority and redirect the login flow.

Once traffic is redirected, a malicious HTA page delivered through the embedded browser runs commands on the workstation, and a live demonstration shows the chain working end to end. The second half covers local privilege escalation. The researcher recovered the key protecting the local channel between client components, got around a process-origin check by duplicating a socket into a helper binary, and abused the update logic's impersonation and file-move steps. A symlink race combined with a separate arbitrary file deletion issue reached SYSTEM.

The findings were reported in 2024, with vendor responses taking months, overlapping reports and a later regression. A practitioner should verify that hardened VPN client settings are applied, avoid trusting DNS or certificate settings pushed by an untrusted network, and treat endpoint VPN software as a serious attack surface.