FortiPy

🔐 FortiPy - Complete Solution

🔍 Step 1: Initial Network Reconnaissance

Begin by scanning the target system to identify available services and potential attack vectors:

The scan reveals the following services:

Key Findings:

• SSH service on port 22 (OpenSSH 10.0)
• Python Flask web application on port 80 using Werkzeug
• Application title: "TechSphere Innovations"

🔍 Step 2: Web Application Initial Access

Navigate to http://<target-ip> to access the TechSphere web application. You'll see a corporate portal with registration and login functionality.

2.1: Create User Account

Click on "Get Started" or "Register" to create a new account:

Complete the registration process to create your account.

2.2: Login to Access Dashboard

After registration, login with your credentials to access the user dashboard. This step is crucial as it provides you with a valid session cookie that you'll need for later exploitation.

Once logged in, you'll see several features:

• Console: Limited command execution (ls, pwd, whoami only)
• Upload: File upload functionality (accepts only .txt files - no use for us)
• Debug: Debug logs section
• Dashboard: Main user interface

🔍 Step 3: Directory Enumeration

Use directory busting to discover hidden endpoints that aren't visible in the main navigation:

This reveals several important endpoints:

• /member_login - Alternative login interface
• /welcome - Welcome page with user parameter
• /sshadmin - SSH administration panel (requires admin access)

🔍 Step 4: Server-Side Template Injection Discovery

4.1: Access Member Login

Navigate to http://<target-ip>/member_login. This page presents a different login interface with a username field.

4.2: Test for SSTI Vulnerability

Enter a basic SSTI payload in the username field:

Submit the form and observe that you're redirected to /welcome with your input reflected. If the page displays "49" instead of "{{7*7}}", you've confirmed SSTI vulnerability.

4.3: Extract Flask Configuration

Use an advanced SSTI payload to extract Flask application configuration:

This payload reveals sensitive configuration information including the Flask SECRET_KEY:

🔍 Step 5: Flask Session Cookie Manipulation

5.1: Capture Current Session Cookie

Open browser Developer Tools (F12) and navigate to the Application/Storage tab. Locate the session cookie (usually named "session") and copy its value.

5.2: Decode Current Cookie

Use flask-unsign to decode your current session cookie and understand its structure:

This reveals the current session structure, typically showing your user role as "user".

5.3: Forge Administrative Cookie

Create a new session cookie with administrative privileges:

5.4: Replace Session Cookie

In the browser Developer Tools:

1. Navigate to Application/Storage → Cookies
2. Find the session cookie
3. Replace its value with the forged administrative cookie
4. Refresh the page

🔍 Step 6: Access SSH Administration Panel

With your forged admin cookie, navigate to http://<target-ip>/sshadmin. You should now have access to the SSH administration panel that displays a list of SSH credentials for users devadmin0 through devadmin24.

The panel reveals multiple SSH credentials, but only one is valid:

🔍 Step 7: SSH Access and User Flag

7.1: Connect via SSH

Use the discovered credentials to connect to the target system:

When prompted, enter the password: secureADMINpass001

7.2: Retrieve User Flag

Once connected, explore the home directory and retrieve the user flag:

🔍 Step 8: Database Configuration Discovery

8.1: Explore Home Directory

Examine the devadmin14 home directory for additional files:

This reveals database credentials:

8.2: Switch to SQL User

Use the discovered credentials to switch to the sqluser account:

Enter the password: sqlpass123

🔍 Step 9: Database Enumeration

9.1: Access SQLite Database

Locate and access the SQLite database:

9.2: Enumerate Database Tables

Within the SQLite prompt, explore the database structure:

This reveals several user password hashes, including:

9.3: Extract Target Hash

Focus on the sqladmin user hash:

🔍 Step 10: Hash Cracking

10.1: Identify Hash Type

The hash appears to be MD5 (32 characters, hexadecimal). Verify using hash identification tools if needed:

10.2: Crack the Hash

Use hashcat to crack the MD5 hash:

The cracked password is: sqlvb60foxpro

10.3: Switch to SQL Admin

Use the cracked password to switch to the sqladmin account:

Enter the password: sqlvb60foxpro

🔍 Step 11: Privilege Escalation to Root

11.1: Check Sudo Privileges

Examine what sudo privileges the sqladmin user has:

This reveals that sqladmin can run sqlite3 with sudo privileges:

11.2: Exploit SQLite Shell Escape

Use the sudo sqlite3 permission to escalate privileges:

Within the SQLite prompt, use the shell escape feature:

11.3: Verify Root Access

Confirm you have root privileges:

11.4: Retrieve Root Flag

Access and retrieve the root flag:

📚 Key Learning Points

• SSTI Exploitation: Server-Side Template Injection can lead to sensitive configuration disclosure
• Flask Security: Exposed secret keys enable session cookie manipulation
• Directory Enumeration: Hidden endpoints often contain administrative functionality
• Session Management: Improper session validation allows privilege escalation
• Credential Reuse: Database credentials found in configuration files enable lateral movement
• Hash Cracking: Weak passwords in databases can be cracked for further access
• Sudo Misconfigurations: Overprivileged sudo rules enable privilege escalation
• Binary Exploitation: SQLite's shell escape feature provides command execution

🛡️ Security Implications

• Input Validation: Properly sanitize user input to prevent SSTI attacks
• Secret Management: Never expose Flask secret keys through SSTI or other vulnerabilities
• Session Security: Implement proper session validation and role checking
• Credential Storage: Avoid storing database credentials in plaintext configuration files
• Password Policies: Enforce strong password policies and avoid weak passwords
• Sudo Configuration: Follow principle of least privilege for sudo rules
• Binary Restrictions: Be cautious when granting sudo access to powerful binaries like sqlite3