5 ms·
Can someone provide some context? A python script alone is kind of hard to decipher.
by zymhan 11y ago
Can someone provide some context? A python script alone is kind of hard to decipher.
- 001spartan 11y agoThere is a hard coded SSH password, 'FGTAbc11*xy+Qqz27', in Fortigate devices < v5.0.7. You can use this script to access any device before that version. EDIT: 5.0.7, not 5.0.2
- zokier 11y agoIt's bit more complex than that; it uses challenge-response system, the "FGTA..." string is used as a "key"
- 001spartan 11y agoCorrect, you can't use the password alone, but the challenge/response method used is readily available online, and easy to implement.
- stcredzero 11y agoApparently, some people who make firewalls believe in security by obscurity. (They could at least have used an RSA key to verify. Though that would still have been bad.)
- mistaken 11y agoI've worked at a large telco testing CPE devices (routers and whatnot) and it was common place to find backdoors like this. The devices were made by a third party vendor and most of them had hardcoded passwords and hidden debug features.
- coldpie 11y agoJust reading the code, it looks like it connects to an SSH session with the name Fortimanager_Access and does some special handling of the password request (see custom_handler) which grants access. Once that's complete, it turns control over to you to type and run commands on the firewall. I don't quite understand the special handling. Looks like it takes a byte from the server's output, hashes a special string containing that byte, and passes that back to the server. This is the backdoor. Edit: Maybe that "special handling" is just standard protocol and it's just sending a plaintext password. I dunno.
- 001spartan 11y agoIt uses a kind of challenge/response, where the device provides a salt that is used with a hardcoded password for that account. It seems to look like 'AK1' + base64(salt|SHA1(salt|password|Fortinet magic)) according to http://fossies.org/linux/john/src/FGT_fmt_plug.c http://fossies.org/linux/john/src/FGT_fmt_plug.c, a cracker for Fortigate passwords.