From f5b8de7665afd2ae47fdfa3239f98985f9ac7599 Mon Sep 17 00:00:00 2001
From: Brandon Hutchinson <bhutch@gmail.com>
Date: Mon, 11 Nov 2024 21:05:43 +0000
Subject: [PATCH 1/3] Create panos-management-panel.yaml

---
 .../panos-management-panel.yaml               | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 http/exposed-panels/panos-management-panel.yaml

diff --git a/http/exposed-panels/panos-management-panel.yaml b/http/exposed-panels/panos-management-panel.yaml
new file mode 100644
index 00000000000..ef14c9889af
--- /dev/null
+++ b/http/exposed-panels/panos-management-panel.yaml
@@ -0,0 +1,37 @@
+id: panos-management-panel
+
+info:
+  name: PAN-OS Management Panel - Detect
+  author: bhutch
+  severity: info
+  description: |
+    PAN-OS management panel was detected.
+  reference:
+    - https://security.paloaltonetworks.com/PAN-SA-2024-0015
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.favicon.hash:873381299
+  tags: panel,panos,login,detect,paloaltonetworks
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/php/login.php?"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<TITLE>Login</TITLE>"
+          - '<form name="login" id="login_form" method="post" autocomplete="off">'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+

From cfa852cce1610bdd7ada34876a3d081c144fda45 Mon Sep 17 00:00:00 2001
From: Brandon Hutchinson <bhutch@gmail.com>
Date: Mon, 11 Nov 2024 21:35:34 +0000
Subject: [PATCH 2/3] Fixed YAML lint error in panos-management-panel

---
 http/exposed-panels/panos-management-panel.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/http/exposed-panels/panos-management-panel.yaml b/http/exposed-panels/panos-management-panel.yaml
index ef14c9889af..67030150018 100644
--- a/http/exposed-panels/panos-management-panel.yaml
+++ b/http/exposed-panels/panos-management-panel.yaml
@@ -34,4 +34,3 @@ http:
       - type: status
         status:
           - 200
-

From d71f2057fc1a08a662b5dd01b7a28a818065a7be Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Tue, 12 Nov 2024 10:06:43 +0530
Subject: [PATCH 3/3] fixed-matcher

---
 http/exposed-panels/panos-management-panel.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/http/exposed-panels/panos-management-panel.yaml b/http/exposed-panels/panos-management-panel.yaml
index 67030150018..e431ee1ec52 100644
--- a/http/exposed-panels/panos-management-panel.yaml
+++ b/http/exposed-panels/panos-management-panel.yaml
@@ -20,7 +20,7 @@ info:
 http:
   - method: GET
     path:
-      - "{{BaseURL}}/php/login.php?"
+      - "{{BaseURL}}/php/login.php"
 
     matchers-condition: and
     matchers:
@@ -28,7 +28,7 @@ http:
         part: body
         words:
           - "<TITLE>Login</TITLE>"
-          - '<form name="login" id="login_form" method="post" autocomplete="off">'
+          - 'PAN_FORM_CONTENT'
         condition: and
 
       - type: status