转：fortios 5.4后门植入

最新推荐文章于 2024-03-18 19:13:49 发布

weixin_30628077

最新推荐文章于 2024-03-18 19:13:49 发布

阅读量1.3k

点赞数

文章标签：运维操作系统 shell

原文链接：http://www.cnblogs.com/studyskill/p/6524672.html

版权

本文介绍了如何在FortiOS 5.4虚拟机中植入后门。通过利用系统的漏洞，可以使用特定命令在升级到5.4后删除并替换系统文件，从而植入恶意代码。在实验过程中，需要一个3.x内核的Linux环境来挂载和修改FortiOS的VMDK文件。操作包括解压系统文件，用msfvenom创建反向shell，然后重新打包并替换原有系统文件。文章最后提到，尽管系统有校验文件，但似乎仅在FIPS模式下启用，而该模式在实际应用中并不常见。

摘要由CSDN通过智能技术生成

提示：

1.经过实验，fortios 5.4 beta4也是可以的。

2.在实验时，选择先下载fortios 5.2(做了快照),再升级5.4，则虚拟机挂载需要选择FortiGate-VM-disk1-000001.vmdk

3.将fortios虚拟机重新打开时，会遇到硬盘id不匹配的问题，只需要修改相应的vmdk文件。

参考：http://www.running-system.com/cannot-open-the-disk-reason-the-parent-virtual-disk-has-been-modified-since-the-child-was-created/

转：https://pulpphikshun.wordpress.com/2015/08/31/backdooring-a-fortios-vm

Backdooring a FortiOS VM

Lately I’ve been playing with FortiOS 5.4 Beta 3 VM. In previous versions of FortiOS, you could use the hidden fnsysctl command to run linux CLI commands (only a subset, unfortunately). For example, if you download the FortiOS 5.2 x86 VM, you can run the command “fnsysctl cat /proc/version”, which will display the Linux kernel version it uses.

For those of you that didn’t know, FortiOS is Linux. They are the same. And FortiOS, up to and including version 5.2, is Linux 2.4. This means that FortiOS does not have ASLR, DEP, stack cookies, or any modern Linux exploit countermeasures. And everything is written in C, and all processes run as root.

Personally, I find this bizarre. The company I work for has FortiGate firewalls, and it’s a little weird to think that the only Linux box we have running kernel 2.4 is the box we’re using to protect all the other Linux boxes. Anyway, I digress.

Back to FortiOS 5.4. It seems that Fortinet is tired of porting third-party vendor SDK driver code back to Linux 2.4, so they decided to upgrade the kernel to 3.2. ASLR is even enabled. Not sure about DEP, but I know stack cookies aren’t enabled. But it also appe