PHP2Shell串连提权攻破PAN-OS服务器
Dream Security称，一起疑似中国黑客借助AI发动的攻击，将PHP2Shell漏洞与Fragnesia Linux内核提权漏洞串联，攻破24台暴露在外的Palo Alto Networks防火墙及一台内部管理服务器。攻击者随后从与美国政府环境有关的防火墙转向内部网络，枚举Active Directory、提取凭据，并尝试密码喷洒、建立后门账号及窃取Keycloak SAML签名密钥。Palo Alto Networks Unit 42已独立确认事件及工具，但Dream未找到AI编写漏洞利用或脚本的直接证据，也未将其认定为自主的国家级攻击。
这次经确认的利用链显示，单个暴露的管理界面可能成为取得root权限、进入内网并攻击Active Directory的入口，而AI参与攻击的证据仍属间接。
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Firewalls in the Wild
On October 25, Dream researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a US government-affiliated environment. The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems.
The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.
The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.
The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure. For government defenders, vulnerability discovery is just the beginning, after which the real challenge extends from identifying vulnerable systems to understanding and containing the access a compromise makes possible.
The research below was conducted with proactive threat hunting using Dream’s autonomous cyber research product,Hero.
#Dream Security#Palo Alto Networks#PHP2Shell#Fragnesia#PAN-OS#Active Directory#Claude Code#aiscan#DeepSeek#Kimi#FOFA#Keycloak