Just reading the code, it looks like it connects to an SSH session with the name Fortimanager_Access and does some special handling of the password request (see custom_handler) which grants access. Once that&#x27;s complete, it turns control over to you to type and run commands on the firewall.<p>I don&#x27;t quite understand the special handling. Looks like it takes a byte from the server&#x27;s output, hashes a special string containing that byte, and passes that back to the server. This is the backdoor.<p>Edit: Maybe that &quot;special handling&quot; is just standard protocol and it&#x27;s just sending a plaintext password. I dunno.