Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2017-14187_PoC_ARMv7 — LPE for FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and below 5.2 | Kitploit
Tools/GitHubGitHub/0xsigill/cve-2017-14187_poc_armv7
Privilege EscalationVulnerability AnalysisExploitationPenetration TestingLearning & EducationRed Teaming
GitHub0xsigill/cve-2017-14187_poc_armv7

CVE-2017-14187_PoC_ARMv7

LPE for FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and below 5.2

View Repository
114 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2017-14187 PoC

Proof-of-Concept of Local Privilege Escalation for FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and below 5.2
Triggered by fnsysctl and USB (so physical access required).
This PoC spawns local root shell by exploiting CVE-2017-14187.

Write-up

Korean
English
TL;DR

  1. fnsysctl cp /usb/payload_path_file /etc/ld.so.preload
  2. fnsysctl ls -> LD_PRELOAD Injection -> Arbitrary Code Execution -> LPE(restricted shell escape)

Build from source

root@kitploit:~
git clone https://github.com/0xSIGILL/CVE-2017-14187_PoC_ARMv7.git
cd CVE-2017-14187_PoC_ARMv7
make

Follow instruction then.

...or you can just get a prebuilt on github release!

Usage

  1. Prepare a USB drive. The USB drive must have a MBR partition and FAT32 or FAT16 fs.
  2. Extract downloaded prebuilt to USB or copy the contents of build directory to your USB drive.
  3. Insert it to your vulnerable FortiGate device.
  4. Open the console via admin webui.
  5. Get system_admin access. If you don't know what it is, go to see the official fortinet document "config system admin"
  6. Type "fnsysctl cp /usb/ld.so.preload /etc" and then enter your super_admin account creds.
  7. Type "fnsysctl ls" or command whatever you want. It will install some symlinks for Busybox shell. Try one more. Then you will get a shell.

This PoC installs a bunch of useful utilities for debugging. Dropbear, GDB, neofetch, and more!

Disclaimer 면책 조항

This project is for educational purposes to demonstrate the CVE-2017-14187 vulnerability in FortiOS. It must not be used for illegal activity or violating rule, or unauthorized harmful activities.
이 프로젝트는 FortiOS에 존재하는 CVE-2017-14187 취약점을 시연하기 위한 교육적 목적으로 만들어졌으며, 불법적 활동이나 규칙을 위반하는 행위, 또는 기타 허가받지 않은 유해한 활동에 사용하는 것을 금지합니다.
It is supplied 'AS IS' basis. I don't have explicit, or implicit legal responsibilities, warranties of any kind.
이 코드는 그 자체로만 제공되며, 어떠한 종류의 명시적, 또는 묵시적인 보증이나 법적 책임이 제공되지 않음을 명시합니다.
Distributed with the GNU General Public License v3.0 (GPLv3).
GPLv3 라이선스 하에 배포됩니다.
Check the LICENSE for more detail.
세부 사항을 보려면 LICENSE를 참조하세요.
FortiOS®, FortiGate® are registered trademark of Fortinet, Inc.
FortiOS®, FortiGate®는 Fortinet, Inc.의 상표입니다.
This project is not related with Fortinet, Inc.
이 프로젝트는 Fortinet, Inc.와 연계되지 않았습니다.

해당 프로젝트는 대한민국 법률을 준수합니다. 이 코드는 공격이나 전산 침해를 위하여 설계된 것이 아니며 개인이 직접 소유한 기기에 물리적 접근을 통해 보안 연구를 위한 디버깅 환경을 구축하는 것에 목적이 있습니다.

Download Tool