Fortigate compromised - how to fully wipe?

[radox3]

I got in touch with non-upgraded Fortigate 100E which got compromised (it had 7.0.8 and WAN HTTPS access enabled :\ ).

The attacker logged in with non-existing accounts to jsconsole (probably known CVE with the version mentioned) and also connected to VPN with existing VPN account (is it possible he got plain text password or the password leaked?).

I cleaned all the users attacker created, checked the configuration, disabled WAN HTTPS, applied GeoIP for VPN and upgraded to 7.2.11 https://1921681254.mx/ .

Despite actions taken the auto-script will create new super admin user every day at 15:30 . There is no auto script listed using [get system auto-script]. Probably something on the OS or bootloader level.

I tried to load firmware from USB flash using [execute restore image usb] but the hidden autoscript still creates new user every day.

How to fully wipe Fortigate and load new clean system using flash drive or TFTP?

[funkylicious]

i think you got some good leads/answers on reddit on how to do it.