cve-2022-1388-iveresk-command-shell

CVE-2022-1388 by 1vere$k コマンドシェル付き 複数のF5製品に影響を与えるCVE-2022-1388の改良版POC。 これは、CVE-2022-1388に対するHorizon3のProof of Conceptの改良版です: https://github.com/horizon3ai/CVE-2022-1388 また、PsychoSecの作業（https://github.com/PsychoSec2/CVE-2022-1388-POC）をリファクタリングして完全に作り直したものです。...

CVE-2022-1388-POC

CVE-2022-1388 PoC by PsychoSec 针对影响多个 F5 产品的 CVE-2022-1388 的改进版 PoC。 这是 Horizon3 的 CVE-2022-1388 概念验证的改进版本： https://github.com/horizon3ai/CVE-2022-1388 此版本包含多项改进以及一个用于运行远程命令的交互式 shell。 技术分析： Horizon3 对该漏洞的技术根源分析可在其博客中找到：...

F5 iControl Server-Side Request Forgery / Remote Command Execution Exploit

This Metasploit module exploits a pre-authentication server-side request forgery vulnerability in the F5 iControl REST API's /mgmt/shared/authn/login endpoint to generate an X-F5-Auth-Token that can be used to execute root commands on an affected BIG-IP or BIG-IQ device. This module requires...

F5 iControl Server-Side Request Forgery / Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'F5 iControl REST Unauthenticated SSRF Token Generation RCE', 'Description' = %q This module exploits a pre-auth SSRF in the F5 iControl REST API'...

F5 iControl REST Unauthenticated SSRF Token Generation RCE

This module exploits a pre-auth SSRF in the F5 iControl REST API's /mgmt/shared/authn/login endpoint to generate an X-F5-Auth-Token that can be used to execute root commands on an affected BIG-IP or BIG-IQ device. This vulnerability is known as CVE-2021-22986. CVE-2021-22986 affects the following...

F5 iControl Remote Root Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "F5 iControl Remote Root Command Execution", 'Description' = %q This module exploits an authenticated remote command execution...

F5 iControl Remote Command Execution

Hi, Linked below is an advisory regarding remote command execution as root, possibly vulnerabilities within the iControl API: http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.html An example request that will set the hostname to 'root.example.com': whoami.example.com This was...