How to Hack Fortinet Firewalls

Are millions of enterprise users, who rely on the next-generation firewalls for protection, actually protected from hackers?

Probably Not.

Just less than a month after an unauthorized backdoor found in Juniper Networks firewalls, an anonymous security researcher has discovered highly suspicious code in FortiOS firewalls from enterprise security vendor Fortinet.

According to the leaked information, FortiOS operating system, deployed on Fortinet's FortiGate firewall networking equipment, includes an SSH backdoor that can be used to access its firewall equipment.

Anyone can Access FortiOS SSH Backdoor

Anyone with "Fortimanager_Access" username and a hashed version of the "FGTAbc11*xy+Qqz27" password string, which is hard coded into the firewall, can login into Fortinet's FortiGate firewall networking equipment.

However, according to the company's product details, this SSH user is created for challenge-and-response authentication routine for logging into Fortinet's servers with the secure shell (SSH) protocol.

This issue affected all FortiOS versions from 4.3.0 to 4.3.16 and 5.0.0 to 5.0.7, which cover FortiOS builds from between November 2012 and July 2014.

Proof-of-Concept Exploit Code is Available Online

The issue was recently reported by an anonymous user (operator8203@runbox.com), who posted the exploit code on the Full Disclosure mailing list this week, helping wannabe hackers generate the backdoor's dynamic password.

System administrators can also make use of this exploit code to automate their testing process in an effort to find out whether they have any vulnerable FortiGuard network equipment laying around.

A Twitter user also shared a screenshot purporting to show someone gained remote access to a server running FortiOS using the exploit code.

The most important fact to be noted here is anyone using this backdoor account doesn't appear in the device's access logs, as the backdoor might be tied to its FortiManager maintenance platform.

Also, there is less chance with professional sysadmins to expose their SSH port online, but this backdoor account can still be exploited by attackers with access to the local network or a virtual LAN, by infecting an organization's computer.

Fortinet Response on the Issue

Fortinet, on its part, attempted to explain why its products were shipped with hard coded SSH logins. According to the company, its internal team fixed this critical security bug (CVE-2014-2216) in version 5.2.3 back in July 2014, without releasing any advisory.

However, Few Hours ago, Fortinet has finally published a security advisory and an official blog post regarding the incident, saying:

"This was not a 'backdoor' vulnerability issue but rather a management authentication issue. The issue was identified by our Product Security team as part of their regular review and testing efforts."

Don't Know How to Login to Your Fortinet Router?

You can login to a Fortinet router in three easy steps:

1. Find Your Fortinet Router IP Address



2. Enter Your Fortinet Router IP Address Into an Internet Browser's Address Bar


3. Submit Your Fortinet Router Username and Password When Prompted By Your Router

For more information on how to login to your Fortinet router please see our Free Guides.

Still can't login to your Fortinet router even when using the username and password for your router?

Reset Fortinet Router Password To Default Settings

(Use this as a last Resort!)

Fortinet Router Password List]

Fortinet
Model	Default Username	Default Password
Fortigate	admin	(none)
Fortigate	maintainer	bcpb+serial#
Fortigate	maintainer	admin

Fortinet Fortigate default configuration

Step 1 

Router default Username is admin
Router default ( initial ) Password is ##blank
Router default IP is 192.168.1.1 ( suggested ) 

---

Step 2 

If the above default configuration ( initial ) about Fortinet Fortigate router is not helping you , the following informations may be useful.
The most popular username / password default login for routers Fortinet are :
( Try 3 combinations then turn off / unplug the router . Then turn it ON and try some more. )

( 1x default username : password )
username : ##blank password : ##blank

( 1x default username : password )
username : admin password : ##blank

( 1x default username : password )
username : maintainer password : ##blank

( 1x default username : password )
username : maintainer password : admin

( suggested default username : password )
username : admin password : 1234

( suggested default username : password )
username : admin password : password

( suggested default username : password )
username : admin password : admin

##Blank - means ... blank ( do not enter nothing )
N/A or na - means not known or any char
##unknown - means not known or any char

---

Step 3 
Most popular IP for the Fortinet routers are : :

( 1x default ip ) 192.168.1.99

( suggested ) 192.168.1.1

Product	Version	Port / Protocol	Username	Default Password	Impact	Notes
FortiGate 300A	n/d	Multi	admin	no password	HTTP
FortiGate firewall		Multi	admin	no password
FortiGate		serial console	maintainer	pbcpbn(add serial number)	Admin
FortiGate		Telnet	admin	(none)	Admin
FortiGate-50B		192.168.1.99	admin	(none)	Admin
FortiGate-60 ADSL		192.168.1.2	admin	(none)	Admin
FortiGate-60		192.168.1.99 or 192.168.1.2 or 10.0.0.1 or 10.10.10.1	admin	(none)	Admin
FortiGate-60B		192.168.1.99	admin	(none)	Admin
FortiWifi-50B		192.168.1.99	admin	(none)	Admin
FortiWifi-60B		192.168.1.99	admin	(none)	Admin

To be continue to next articles.........