Hacker News Reader

Comment by zymhan | Hacker News Reader

Can someone provide some context? A python script alone is kind of hard to decipher.

Just reading the code, it looks like it connects to an SSH session with the name Fortimanager_Access and does some special handling of the password request (see custom_handler) which grants access. Once that's complete, it turns control over to you to type and run commands on the firewall.

I don't quite understand the special handling. Looks like it takes a byte from the server's output, hashes a special string containing that byte, and passes that back to the server. This is the backdoor.

Edit: Maybe that "special handling" is just standard protocol and it's just sending a plaintext password. I dunno.

It uses a kind of challenge/response, where the device provides a salt that is used with a hardcoded password for that account. It seems to look like 'AK1' + base64(salt|SHA1(salt|password|Fortinet magic)) according to http://fossies.org/linux/john/src/FGT_fmt_plug.c, a cracker for Fortigate passwords.

There is a hard coded SSH password, 'FGTAbc11*xy+Qqz27', in Fortigate devices < v5.0.7. You can use this script to access any device before that version.

EDIT: 5.0.7, not 5.0.2

It's bit more complex than that; it uses challenge-response system, the "FGTA..." string is used as a "key"

Correct, you can't use the password alone, but the challenge/response method used is readily available online, and easy to implement.

Apparently, some people who make firewalls believe in security by obscurity. (They could at least have used an RSA key to verify. Though that would still have been bad.)

I've worked at a large telco testing CPE devices (routers and whatnot) and it was common place to find backdoors like this. The devices were made by a third party vendor and most of them had hardcoded passwords and hidden debug features.

Reply on news.ycombinator.com