This is how one would reset their master password on the device.
Physical access always trumps all other forms of security.
Cisco routers can have their password reset if you gain physical access to them as well.
And (if nothing else), this method is not new, and is well documented by Fortigate.
Matt Gibson - GSEC FCSE
-----Original Message-----
From: Johan Andersson [mailto:andersson (at) one (dot) se [email concealed]]
Sent: June 1, 2005 4:10 PM
To: bugtraq (at) securityfocus (dot) com [email concealed]
Subject: Backdoor in Fortinet´s firewall Fortigate
If you have console access to this box, you are able to get root access
or more by using the Username: maintainer
Password: pbcpbn[here should you type the serialnr. of the box, the
characters should be in Capital letters.]
FortiOS: 2.x
Regards
Johan Andersson
Atea Security, Sweden
Phone: +46-709-19 71 76
Mail: johan.andersson (at) atea (dot) com [email concealed]
This is how one would reset their master password on the device.
Physical access always trumps all other forms of security.
Cisco routers can have their password reset if you gain physical access to them as well.
And (if nothing else), this method is not new, and is well documented by Fortigate.
Matt Gibson - GSEC FCSE
-----Original Message-----
From: Johan Andersson [mailto:andersson (at) one (dot) se [email concealed]]
Sent: June 1, 2005 4:10 PM
To: bugtraq (at) securityfocus (dot) com [email concealed]
Subject: Backdoor in Fortinet´s firewall Fortigate
If you have console access to this box, you are able to get root access
or more by using the Username: maintainer
Password: pbcpbn[here should you type the serialnr. of the box, the
characters should be in Capital letters.]
FortiOS: 2.x
Regards
Johan Andersson
Atea Security, Sweden
Phone: +46-709-19 71 76
Mail: johan.andersson (at) atea (dot) com [email concealed]
[ reply ]