FortiJump: Pre-authentication RCE in FortiManager fgfmd

This repository contains two files: 'c.py' and 'start.sh'. The 'c.py' file contains an obfuscated Python payload, encoded with base64 and compressed with zlib. The 'start.sh' script installs the 'requests' library, writes a temporary Python script to '/tmp/1.py' that decodes and executes the obfuscated payload, and then runs this script in the background. The actual functionality of the payload is hidden due to the obfuscation, but the structure suggests it is designed to execute arbitrary or malicious code on the host system. There are no explicit network endpoints or CVE targets visible in the unobfuscated code, but the use of obfuscation and temporary file execution is typical of malware or post-exploitation tools. The repository is not part of a known exploit framework and appears to be a standalone, potentially malicious script.

This repository is a proof-of-concept exploit for CVE-2024-47575 targeting Fortinet FortiManager. The main code is in 'src/exploit.py', a Python script that connects to a target FortiManager device over SSL (TCP port 541) using a client certificate and key (w00t_cert.bin, w00t_key.bin). The script supports two modes: 'check' (to test for vulnerability) and 'exploit' (to gain a reverse shell). It crafts and sends a series of protocol-specific requests to the target, leveraging the vulnerability to execute a bash reverse shell payload. The exploit requires the attacker to specify their own IP and port for the reverse shell connection. The repository also includes a minimal README and a .gitignore; all exploit logic resides in the Python script.

This repository contains a single Metasploit module (Ruby) that exploits CVE-2024-47575, a critical unauthenticated remote code execution vulnerability in Fortinet FortiManager and FortiManager Cloud devices. The exploit targets the FGFM service, typically running on TCP port 541 with SSL enabled. The module leverages a missing authentication check, allowing an attacker with a valid Fortinet-signed client certificate (provided by default in the module) to execute arbitrary commands as root on the target system. The module supports user-supplied certificates and allows customization of the serial number and platform if needed. The exploit is operational and provides root-level command execution on a wide range of FortiManager and FortiManager Cloud versions. The code is well-structured, with clear options for certificate/key paths and serial/platform overrides, and includes a check method to verify if the target is a FortiManager device by inspecting its SSL certificate. No hardcoded IPs or domains are present, but the default port (541) and writable directory (/tmp) are fingerprintable endpoints.

This repository contains a Python exploit for CVE-2024-47575, a critical unauthenticated remote code execution vulnerability in Fortinet FortiManager and FortiManager Cloud. The main exploit script, CVE-2024-47575.py, connects to the target's management interface on TCP port 541 using a provided client certificate and key (w00t_cert.bin and w00t_key.bin). It supports two modes: 'check' (to test for vulnerability) and 'exploit' (to gain a reverse shell). In exploit mode, it sends a crafted payload that causes the target to execute a shell command, opening a reverse shell to the attacker's specified host and port. The README provides usage instructions and lists affected product versions. The repository is operational, providing a working exploit with a hardcoded payload, and is not part of a larger framework.

This repository provides a proof-of-concept exploit for CVE-2024-47575, a critical unauthenticated remote code execution vulnerability in Fortinet FortiManager and FortiManager Cloud. The main exploit script, 'CVE-2024-47575-poc.py', is a Python tool that connects to the target's TCP port 541 using a custom SSL context with provided certificate and key files. It crafts and sends a series of protocol-specific requests to the fgfmsd daemon, exploiting the lack of authentication to first check for vulnerability and then, if exploitable, to send a payload that executes a reverse shell command. The attacker can specify their own host and port for the reverse shell. The repository includes the necessary certificate and key files, a README in Chinese explaining the vulnerability and its impact, and standard licensing and gitignore files. The exploit is operational and demonstrates full remote code execution capability, requiring only network access to the target and the included certificate/key files.

This repository contains a functional exploit for CVE-2024-47575, an unauthenticated remote code execution vulnerability in Fortinet FortiManager and FortiManager Cloud. The main exploit script (CVE-2024-47575.py) is written in Python and leverages a custom SSL connection (using provided certificate and key files) to communicate with the target's management port (TCP 541). The script supports two modes: 'check' (to test for vulnerability) and 'exploit' (to gain code execution). In exploit mode, it sends a crafted payload that causes the target to execute a bash reverse shell, connecting back to the attacker's specified IP and port. The repository also includes a README with usage instructions and a list of affected product versions, as well as the necessary certificate and key files for SSL communication. The exploit is operational and provides a working reverse shell if the target is vulnerable and accessible.