Headline
Simple Universal Fortigate Fuzzer
This python script is a tool for fuzzing Fortigate 7.
c@ubuntu:~/LABS/_SUFLET2$ cat suff.py#!/usr/bin/env python3# suff.py -- simple universal fortigate fuzzer## initial idea : xx.10.2022# finished idea: xx.04.2023# # special thanks goes to Reykez (https://github.com/Reykez)# # for more details:# https://code610.blogspot.com/2023/04/fuzzing-fortigate-7.html #from netmiko import Netmikoimport sys,osimport timeimport paramikodef readFile(filename): words = [] fileText = open(filename.strip(), 'r') for line in fileText.readlines(): for word in line.strip().split(): words.append(word.strip()) words.append('\n') return words##def writeFile(words, filename): text = ''; for word in words: text += word; if word!='\n': text += ' ' ; f = open(filename, 'w') f.write(text) f.close() ## run modified payload: send is as cfg: fpread = open(filename, 'r') lines = fpread.read() command = lines print("DEBUG :::: type of: %s" % type(command) ) print( command ) print("DEBUG :::: eof\n") ## # set up for the target fw_01 = { 'host':'192.168.56.231', 'username':'admin', 'password':'admin', 'device_type':'fortinet' } # connecting to the target host try: net_connect = Netmiko( **fw_01 ) print("+ connected, checking prompt...") except paramiko.ssh_exception.SSHException as e: print(" > connection error: %s" % e) except ConnectionResetError as e: print("> connection error2: %s" % e) except UnboundLocalError as e: print("UnboundLocalError: local variable 'net_connect' referenced before assignment") print("> unbound variable error: %s" % e) print("... sleeping 1...") time.sleep(2) print("> sending fuzzed command...") send_init_cfg = net_connect.send_config_set( command ) # init_cfg... print("+ looks like we just sent this command:\n\t%s\n\n" % send_init_cfg ) ## finished fuzzed super-payload attack ######def modifyFilename(filename, number): name, extension = os.path.splitext(filename) return "{name}{uid}{extension}".format(name=name, uid=str(number).zfill(2), extension=extension)#### parse and validate command line args, proceed programargs = sys.argv[1:]filename = args[0] if 0 in range(len(args)) else input ('Filename?')textToReplace = args[1] if 1 in range(len(args)) else input ('text to replace? ')outputBasename = args[2] if 2 in range(len(args)) else input ('output basename')words = readFile(filename);# reaplce any occurency and printfileIndex = 0for wordIndex in range(len(words)): if words[wordIndex] == '\n': continue fileIndex += 1 wordsCopy = words.copy() try: wordsCopy[wordIndex] = textToReplace writeFile(wordsCopy, modifyFilename(outputBasename, fileIndex ) ) except UnboundLocalError as e: print("UnboundLocalError: local variable 'net_connect' referenced before assignment") print("> unbound variable error: %s" % e) passprint('Successfully generated', modifyFilename(outputBasename, 1), '-', modifyFilename(outputBasename, fileIndex), ' files!')