ayewo

GitHub · Repository owner · Source ID 20957603
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

ayewo/fortios-ldap-mitm-poc-CVE-2019-5591

Repository PoC1Created 2025-10-16ExploitCVE-2019-55914 files

21.0 KiB

GitHubPoC details
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

A Python-based LDAP honeypot server that impersonates a legitimate LDAP server to intercept credentials from a vulnerable FortiOS device via a Man-in-the-Middle (MITM) attack. It parses LDAP BIND requests to extract usernames and passwords, and attempts to exfiltrate captured credentials by making an HTTP GET request to a URL derived from the captured password.

Backdoor review

Suspicious behavior

The PoC for CVE-2019-5591 is a local LDAP honeypot server that captures credentials from a FortiGate device. The primary behavior is disclosed. However, the server contains an automatic, unconditional outbound GET request to the captured password string, which is treated as a URL. This behavior is not disclosed in the README and is materially misrepresented as a simple credential capture. It silently exfiltrates the captured credential to an external, attacker-controlled destination embedded in the credential itself, which is a deceptive and harmful action against the operator.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespythondockerfile
Target softwareFortinet FortiOS
Attack typesman-in-the-middlecredential interceptionexfiltration
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a fully functional LDAP honeypot server (ldap_honeypot.py) designed to actively intercept and exfiltrate credentials from a vulnerable FortiOS device. The README explicitly describes it as a 'Proof of Concept (PoC) demonstrates a MITM (Man-In-The-Middle) Attack: impersonation of an LDAP server' and includes a log showing captured credentials. The code goes beyond detection by extracting passwords and attempting to send them to an external URL, which constitutes exploitation.

README.md:3-4ldap_honeypot.py:250-276

Requirements

  • Attacker must be on the same subnet as the vulnerable FortiGate device to intercept LDAP traffic.README.md:3-4
  • The target FortiGate must be running a vulnerable version of FortiOS (6.0.3 through 6.2.0) with default LDAP configuration that does not verify server identity.README.md:8-13

Observed behavior

  • Starts an LDAP server on port 389 to accept connections from the target.ldap_honeypot.py:321-332
  • Parses incoming LDAP BIND requests to extract the DN and password.ldap_honeypot.py:84-122
  • Captures the password from the second BIND request (request #3) and attempts to exfiltrate it by making an HTTP GET request to a URL derived from the password string.ldap_honeypot.py:250-276
  • Responds to LDAP SEARCH requests with a success result to maintain the illusion of a legitimate LDAP server.ldap_honeypot.py:283-302
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Exfiltration
  • The ldap_honeypot.py server automatically makes an outbound GET request to the captured password string, treating it as a URL. This behavior is not disclosed in the README or the script's docstring, which only mention logging captured credentials. The README example shows a password containing an oast.pro domain, indicating the captured credential is designed to be a callback URL, enabling silent exfiltration of the exploit results to an external server without the operator's knowledge or consent.ldap_honeypot.py:255-276README.md:44-50

Observables

Url
Payload withheldExample captured password from README that is automatically fetched by the server, demonstrating the exfiltration mechanism.README.md:45ldap_honeypot.py:265
Behavior
Payload withheldThe server unconditionally performs an HTTP GET request to the captured password, which is a deceptive exfiltration mechanism not disclosed to the operator.ldap_honeypot.py:255-276
Review boundaries

What the analysis did not establish

  • One file (add_fortigate_user.ldif) is omitted from the evidence, but its content is not required for classification as the exploit logic is fully present in ldap_honeypot.py.
  • The evidence does not include the actual network interception mechanism (e.g., ARP spoofing) required to redirect traffic; the honeypot assumes traffic is already directed to it.
  • The review is based solely on the provided text files. The binary file (add_fortigate_user.ldif) was not inspected, but its content is not expected to alter the verdict given the clear exfiltration behavior in the Python script.
  • The actual reachability or ownership of the oast.pro domain is not verified, but the mechanism itself is the concern.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.