Check Point Gateway Exploitation: PHP2Shell and TSGA Backdoor Targeting Israeli Organizations

---
title: Check Point Gaia OS PHP2Shell Exploitation Attempt
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects PHP2Shell exploitation attempts against Check Point Gaia OS web interface via suspicious process spawning from web server context
references:
  - https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_web_parent:
    ParentImage|contains:
      - '/opt/CPshrd-R81.20/bin/cpwmd'
      - '/opt/CPsuite-R81.20/fw1/bin/cpwd'
      - 'httpd'
      - 'php'
  selection_shell:
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/bin/wget'
      - '/usr/bin/curl'
  condition: selection_web_parent and selection_shell
falsepositives:
  - Legitimate Check Point updates or administrative scripts
level: high
---
title: TSGA Backdoor Persistence Mechanism
id: 8e7d6c5b-4a3b-2c1d-0e9f-8a7b6c5d4e3f
status: experimental
description: Detects TSGA backdoor installation through modification of Check Point Gaia OS system binaries and startup scripts
references:
  - https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.persistence
  - attack.t1543.002
  - attack.t1053.003
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/etc/rc.d/init.d/'
      - '/etc/init.d/'
      - '/etc/rc.local'
      - '/opt/CPshrd-R81.20/bin/'
      - '/opt/CPsuite-R81.20/fw1/bin/'
      - '/usr/bin/sshd'
      - '/sbin/init'
  selection_exclusions:
    SourceImage|contains:
      - 'rpm'
      - 'yum'
      - 'cp_update'
      - 'upgrade_tools'
  condition: selection_paths and not selection_exclusions
falsepositives:
  - Legitimate Check Point software updates
  - System administrators making authorized changes
level: high
---
title: ESXi Destructive Command Execution
id: 7d6c5b4a-3b2c-1d0e-9f8a-7b6c5d4e3f2a
status: experimental
description: Detects destructive file operations targeting VMware ESXi filesystems associated with TSGA wiper activity
references:
  - https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.impact
  - attack.t1485
  - attack.t1561.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_commands:
    CommandLine|contains:
      - 'rm -rf /vmfs/volumes/'
      - 'rm -rf /etc/vmware/'
      - 'dd if=/dev/zero of=/dev/'
      - 'mkfs.ext4'
      - 'shred -n 3 -z /vmfs'
      - 'esxcli system coredump file set -p false'
  condition: selection_commands
falsepositives:
  - Storage decommissioning activities
  - Authorized ESXi rebuilds
level: critical

// Hunt for PHP2Shell exploitation attempts via Check Point Gaia web interface
Syslog
| where Facility == "local4" or Facility == "daemon"  // Common Check Point facilities
| where ProcessName contains "httpd" or ProcessName contains "php"
| where SyslogMessage has_any ("cmd=", "exec=", "system(", "passthru(", "shell_exec")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "wget", "curl", "python")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc
;

// Detect TSGA persistence via suspicious SSH binary modifications on Check Point gateways
SecurityEvent
| where EventID == 4688  // Process creation
| where NewProcessName endswith "sshd" or NewProcessName endswith "cpwd"
| where CommandLine has_any ("-o PermitRootLogin=yes", "-o PasswordAuthentication=yes", "-f /dev/null")
| where ParentProcessName !endswith "systemd" and ParentProcessName !endswith "init"
| project TimeGenerated, Computer, NewProcessName, CommandLine, ParentProcessName, Account
;

// Hunt for ESXi destructive commands via Linux auditd or process execution
DeviceProcessEvents
| where DeviceName has_any ("esxi", "vmware", "vcenter")
| where ProcessCommandLine has_any ("rm -rf", "dd if=", "mkfs", "shred")
| where ProcessCommandLine has_any ("/vmfs/volumes", "/etc/vmware", "/dev/sd", "datastore")
| where InitiatingProcessAccountName !in ("root", "vpxuser", "dcui")  // Exclude normal management
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessAccountName, FileName
| order by TimeGenerated desc
;

// Network connections from Check Point gateways to ESXi management ports
CommonSecurityLog
| where DeviceVendor == "Check Point"
| where DestinationPort in (902, 443, 22, 5989)  // ESXi management ports
| where SourceIP in (CheckPoint_Gateways)  // Define your gateway IPs
| where Activity == "Accept" or Activity == "Allow"
| summarize count() by SourceIP, DestinationIP, DestinationPort, TimeGenerated
| where count_ > 10  // Threshold for unusual management traffic
| order by count_ desc

-- Hunt for TSGA backdoor artifacts and suspicious processes on Check Point Gaia OS
SELECT 
    Pid, 
    Name, 
    CommandLine, 
    Exe, 
    Username, 
    CreateTime,
    hash(path=Exe) as BinaryHash
FROM pslist()
WHERE 
    (Name =~ "sshd" OR Name =~ "cpwd" OR Name =~ "clish")
    AND (
        CommandLine =~ "-o" 
        OR Exe !~ "/opt/CP"  // Binary moved from expected location
        OR Username =~ "nobody"  // Suspicious user context for these binaries
    )

-- Check for recent modifications to critical system binaries
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    hash(path=FullPath) as FileHash
FROM glob(globs="/opt/CP*/bin/*", accessor="file")
WHERE Mtime > ago(30d)  // Modified in last 30 days
    AND FullPath =~ "sshd|cpwd|clish|cpca"

-- Hunt for suspicious files in temp directories (common TSGA staging)
SELECT 
    FullPath,
    Size,
    Mtime,
    hash(path=FullPath) as FileHash
FROM glob(globs="/tmp/*", accessor="file")
WHERE 
    Size > 100000  // Larger than typical temp files
    AND (
        FullPath =~ "cp_install|gaia_update|hotfix|patch"
        OR FullPath =~ "\.elf$"
        OR FullPath =~ "\.so$"
    )

-- Network connections from Check Point gateways to ESXi infrastructure
SELECT 
    Pid,
    Name,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort,
    Status,
    CommandLine
FROM netstat()
WHERE 
    RemotePort in (22, 443, 902, 5989, 8000)  // ESXi/vCenter management ports
    AND Name =~ "sshd|cpwd|php|httpd"  // Web or SSH processes making outbound connections
    AND RemoteAddr =~ "^10\\.|^172\\.|^192\\.168\\."  // Internal RFC1918 ranges

#!/bin/bash
# Check Point TSGA Backdoor Detection and Hardening Script
# Run as root on Gaia OS
# Version: 1.0 - November 2026

echo "=== Check Point Security Gateway Hardening Script ==="
echo "Scanning for TSGA indicators and PHP2Shell compromise..."
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
LOGFILE="/var/log/tsga_scan_$TIMESTAMP.log"

# Function to log findings
log_finding() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOGFILE"
}

# 1. Verify system binary integrity (Check Point specific paths)
log_finding "Verifying critical system binaries..."
CRITICAL_BINS="/opt/CPshrd-R81.20/bin/cpwd /opt/CPsuite-R81.20/fw1/bin/cpwd /usr/bin/sshd /bin/clish"
for bin in $CRITICAL_BINS; do
    if [ -f "$bin" ]; then
        # Check if binary was modified in last 60 days (adjust as needed)
        if [ $(find "$bin" -mtime -60) ]; then
            log_finding "WARNING: $bin modified recently - verify with rpm or md5sum against known good"
            rpm -Vf "$bin" 2>/dev/null | grep -v "^missing" && log_finding "Integrity check failed for $bin"
        fi
    fi
done

# 2. Check for unauthorized SSH keys
log_finding "Checking for unauthorized SSH authorized_keys..."
find /home -name "authorized_keys" -mtime -30 -exec ls -la {} \; | tee -a "$LOGFILE"
find /root/.ssh -name "authorized_keys" -mtime -30 -exec cat {} \; | grep -v "^#" | tee -a "$LOGFILE"

# 3. Detect suspicious processes
log_finding "Checking for suspicious processes..."
ps aux | grep -E "(sshd|cpwd|httpd)" | grep -v grep | awk '{print $1, $2, $11, $12}' | while read user pid cmd args; do
    if [ "$user" == "nobody" ] && [[ "$cmd" == *"sshd"* ]]; then
        log_finding "CRITICAL: sshd running as nobody user (PID: $pid) - possible TSGA backdoor"
    fi
done

# 4. Check startup scripts for TSGA persistence
log_finding "Scanning startup scripts for unauthorized modifications..."
find /etc/rc.d /etc/init.d -type f -mtime -30 -exec grep -l "bash\|sh\|python\|perl" {} \; 2>/dev/null | tee -a "$LOGFILE"

# 5. Network connections to ESXi infrastructure (if applicable)
log_finding "Checking for suspicious outbound connections to ESXi management ports..."
netstat -tulpn | grep -E ":(902|443|22|5989)" | grep -E "(sshd|httpd|php)" | tee -a "$LOGFILE"

# 6. PHP2Shell specific checks
log_finding "Checking for PHP2Shell webshell artifacts..."
find /opt/CPsuite-R81.20/fw1/htdocs /var/log/httpd -name "*.php" -mtime -30 -exec grep -l "eval\|system\|passthru\|shell_exec" {} \; 2>/dev/null | tee -a "$LOGFILE"

# 7. Apply emergency hardening (DISABLE HTTP/HTTPS management if not required)
log_finding "Applying emergency hardening..."
read -p "Disable web management interface? (y/n) " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    clish -c "set web daemon-enable off" 2>/dev/null && log_finding "Disabled web management interface"
    clish -c "set ssh server-enable on" 2>/dev/null && log_finding "Ensured SSH is enabled for management"
fi

# 8. Enable comprehensive logging
log_finding "Enabling detailed audit logging..."
clish -c "set syslog log-remote-syslog enable" 2>/dev/null
clish -c "set syslog log-level debug" 2>/dev/null

# 9. Check for available hotfixes (requires internet connectivity or local repository)
log_finding "Checking for Check Point updates..."
echo "Please verify you have applied the November 2026 PHP2Shell hotfix:"
echo "- Gaia OS R81.20: Install Jumbo Hotfix Take 142 or later"
echo "- Gaia OS R81.10: Install Jumbo Hotfix Take 168 or later"
echo "- Gaia OS R80.40: Contact Check Point support for specific hotfix"

# 10. IOC Sweep - Check for known TSGA hashes (replace with actual IOCs from threat intel)
log_finding "Scanning for known malicious file hashes..."
KNOWN_BAD_HASHES=(
    "a1b2c3d4e5f6..."  # Replace with actual TSGA hashes from Check Point advisory
    "b2c3d4e5f6a7..."
)
for hash in "${KNOWN_BAD_HASHES[@]}"; do
    find / -type f -exec md5sum {} + 2>/dev/null | grep "$hash" && log_finding "CRITICAL: Found known malicious file hash: $hash"
done

echo ""
echo "=== Scan Complete ==="
echo "Results logged to: $LOGFILE"
echo ""
echo "IMMEDIATE ACTIONS REQUIRED:"
echo "1. If any CRITICAL findings above, isolate this gateway immediately"
echo "2. Apply Check Point hotfixes for PHP2Shell (November 2026 release)"
echo "3. Rotate all credentials stored on this device"
echo "4. Review ESXi infrastructure for unauthorized access or encryption"
echo "5. Contact Security Arsenal IR team if compromise is confirmed"