Check Point IKEv1 Remote Access VPN Authentication Bypass

Repository contains a single substantive Python exploit/detection artifact generator plus a README. The Python script is a standalone operational exploit for CVE-2026-50751 affecting Check Point Remote Access VPN / Mobile Access when legacy IKEv1 Remote Access is enabled. Its core capability is to authenticate as a known provisioned Remote Access username without possessing a valid client certificate, private key, or password. The exploit implements substantial protocol logic itself rather than relying on an external framework: socket transport, IKEv1/ISAKMP message construction, Diffie-Hellman group 2 exchange, RFC 2409 key derivation, HMAC-SHA1 PRF, AES-CBC encryption/decryption, and X.509 certificate generation using Python cryptography. Based on the comments and CLI, it forges a self-signed certificate whose subject DN matches the target user and abuses the vulnerable gateway behavior where attacker-controlled VPNExtFeatures flags cause peer-auth/signature verification to be skipped. Success is determined by whether phase 1 is granted and the gateway treats the session as authenticated for that user. Repository structure is minimal: README.md documents the vulnerability, prerequisites, usage, and expected output; watchTowr-vs-Check-Point-CVE-2026-50751.py is the main and only code file. The script accepts a remote host, remote port, username to impersonate, optional organization and OU values for the forged DN, timeout/retry settings, and a TCPT mode for Visitor Mode over raw TCP 443. It can target standard IKE over UDP 500 or 4500, or Check Point Visitor Mode over TCP 443. This is not merely a detector in the narrow sense: although branded as a detection artifact generator, it actively performs the authentication bypass against the target and confirms exploitation when the gateway authenticates the supplied username. No post-auth remote code execution payload is included; the exploit’s result is unauthorized VPN authentication / identity impersonation at the IKEv1 phase-1 level.