XORtigate: Pre-authentication RCE in FortiOS and FortiProxy SSL-VPN

This is a 100-file exploit catalog rather than a detection-only repository: the supplied structure contains README.md, .gitignore, and 98 standalone Python clients in exp/. Filenames encode a FortiGate appliance SKU and exact FortiOS build, spanning models such as 30E through 3000D and firmware trains from 6.0 through 7.4. The critical asset is the per-image offset/gadget matrix: every client hardcodes build-specific stack layouts, BSS/GOT/function addresses, ROP gadgets, object sizes, and spray parameters. The code implements two unauthenticated SSL-VPN RCE families identified in the README as CVE-2024-21762 and CVE-2023-27997. CVE-2024-21762-style clients issue malformed chunked POST requests to /aaaa/bbbb while spraying /remote/error or /remote/hostcheck_validate. They corrupt request-processing state, redirect control flow through per-build ROP chains, and invoke FortiGate's internal execute_cmd routine. CVE-2023-27997-style clients first obtain a dynamic salt from /remote/info, reproduce the MD5/XOR enc= encoding, calculate seeds for controlled byte writes, spray SSL-related objects, and overwrite an indirect target/GOT entry to execute attacker-controlled commands. Payload delivery has three observed forms: direct Node.js HTTP retrieval and eval of a configurable /s.js URL; TFTP retrieval of s.js into /tmp/s followed by Node execution; and x86-64/ARM raw-payload stagers. The latter obtain a length-prefixed second stage from a configurable TCP service, allocate executable memory, execute the received bytes, and make a second configurable TCP callback that functions as a reverse shell channel. TLS certificate verification is disabled throughout. Many clients repeatedly attack in parallel, with hardcoded CPU/thread counts and high connection/spray volumes, indicating reliability tuning rather than a minimal PoC. No fixed victim IP, domain, or attacker infrastructure is embedded. Target and callback hosts/ports are command-line supplied, so the fingerprintable observables are primarily the SSL-VPN paths, malformed chunked-transfer patterns, unusually large form/hostcheck requests, the FortiSSLVPN user agent, requests to /remote/info, and outbound target traffic to operator-selected HTTP, TFTP, or raw TCP services. README references additional launcher, listener, shellcode, and JavaScript files, but those are not present in the supplied file listing; conclusions about their contents are therefore limited to the README's description.

This repository provides a Python proof-of-concept exploit for CVE-2023-27997, a critical heap-based buffer overflow vulnerability in Fortinet FortiGate SSL-VPN (FortiOS) devices. The exploit consists of a single main script ('fgt-cve-2023-27997-exploit.py'), a README.md with detailed usage and technical background, and a requirements.txt listing dependencies (requests, urllib3, numpy, scipy). The exploit works by first retrieving a 'salt' value from the target's '/remote/info' endpoint, then crafting a ROP chain payload (demonstrated with a ping command), encrypting it, and sending it to the vulnerable '/remote/hostcheck_validate' endpoint as the 'enc' parameter. The script is designed for authorized testing and demonstrates remote code execution (RCE) without authentication. The README provides affected version ranges for FortiOS and FortiProxy, usage instructions, and technical details about the vulnerability and exploit chain. The attack vector is network-based, targeting the SSL-VPN web interface. The exploit is a PoC and requires the attacker to specify the target IP and port.

This repository contains a proof-of-concept (POC) exploit for CVE-2023-27997, a critical remote code execution vulnerability in Fortinet FortiGate SSL VPN devices. The main file, 'exploit.py', is a heavily commented Python script that demonstrates the exploitation process, including buffer overflow and ROP chain construction, but does not provide a fully weaponized payload. The exploit requires the attacker to specify the target (host:port) and a local callback address. It uses custom SSL/TLS connections and crafts HTTP(S) requests to the '/remote/error' endpoint on the target device. The script is intended for educational purposes and does not include fingerprinting or vulnerability checks. The README.md provides a brief overview and points to a detailed blog post for further information. The exploit demonstrates the attack vector and methodology but is not directly usable for real-world attacks without further development.