The script is designed to detect CVE-2024-23113, which is a format string vulnerability in the FortiGate FGFM service (FortiGate to FortiManager protocol) running on TCP port 541. The vulnerability occurs because an attacker can control a format string, which could lead to Remote Code Execution (RCE) or other unintended behaviors. The FGFM service allows communication between FortiGate devices and FortiManager for configuration management, and an unpatched version has improper handling of input, making it susceptible to a format string exploit. How the Script Works
Network Connection Setup:
The script first sets up an SSL/TLS connection to the target on port 541.
It uses the ssl.SSLContext object with certificate verification disabled to establish the connection, as the device might have self-signed certificates.
Payload Construction:
Once connected, the script crafts a malicious payload using a format string exploit (authip=%n). The %n directive tells the system to write the number of bytes output so far into a variable, which can potentially lead to memory corruption.
The crafted payload is sent to the target through the established connection.
Detection Logic:
The script then checks the target's behavior in response to the payload.
If the connection is abruptly terminated and an SSL alert is raised, it suggests that the target is vulnerable because it triggered the format string vulnerability protection mechanisms (e.g., _FORTIFY_SOURCE in glibc).
If the connection remains open, the target is likely patched.
Usage Instructions
Run the Script:
Run the script with Python 3 by executing:
sh
python check_vulnerability.py
Enter Hostname/IP:
You will be prompted to enter a hostname or IP address to check if it is vulnerable.
If you want to stop, type exit.
Output:
If the target is vulnerable, the script will output:
[!] Warning: is vulnerable!
If the target is patched, it will output:
[+] <hostname> appears to be patched.
Requirements
Python 3 installed on the machine running the script.
Network access to the target device, ensuring port 541 is open.
The FGFM service must be running on the target device.