F5 BIG-IP/BIG-IQ iControl REST Unauthenticated Remote Command Execution

This repository contains a single Metasploit module (modules/exploits/linux/http/f5_icontrol_rest_ssrf_rce.rb) that exploits CVE-2021-22986, a critical unauthenticated SSRF and remote code execution vulnerability in the F5 BIG-IP and BIG-IQ iControl REST API. The exploit leverages a flaw in the /mgmt/shared/authn/login endpoint to generate a valid authentication token via SSRF, which is then used to execute arbitrary commands as root on the target device. The module supports both direct command execution (e.g., reverse shell) and staged payloads (e.g., Meterpreter). The code is written in Ruby and is designed for use within the Metasploit framework, providing weaponized exploitation capabilities. The main attack vector is network-based, targeting the HTTPS management interface of vulnerable F5 devices. The module is highly configurable, allowing the operator to specify payloads and target endpoints. The exploit is operational and has been tested against multiple versions of BIG-IP. Notable endpoints include /mgmt/shared/authn/login and /mgmt/shared/authz/users/<username>.

This repository contains a Python exploit script (CVE-2021-22986.py) targeting F5 BIG-IP and BIG-IQ devices vulnerable to CVE-2021-22986, a critical unauthenticated remote command execution flaw in the iControl REST API. The exploit works by first attempting to leak or forge an authentication token via the /mgmt/shared/authn/login endpoint. If successful, it uses this token to send commands to the /mgmt/tm/util/bash endpoint, providing the attacker with an interactive shell for arbitrary command execution on the target device. The script is operational and provides a real shell, not just a proof of concept. The README provides a brief description and usage instructions. No hardcoded IPs or domains are present; the script requires the user to supply the target host. The exploit is network-based and requires HTTPS access to the vulnerable API endpoints.

This repository is a collection of Proof-of-Concept (POC) exploits for three critical vulnerabilities affecting F5 BIG-IP devices: CVE-2020-5902, CVE-2021-22986, and CVE-2022-1388. The code is written in Go and consists of four main files: one for each CVE and a main orchestrator (F5.go). The main entry point (F5.go) parses command-line arguments for the target URL and command to execute, then sequentially tests each vulnerability. - CVE-2020-5902 exploit attempts to read the /etc/passwd file via a crafted HTTP GET request, indicating a successful exploit if the file is retrieved. - CVE-2021-22986 and CVE-2022-1388 exploits send crafted HTTP POST requests to the /mgmt/tm/util/bash endpoint, attempting to execute arbitrary shell commands (default is 'id', but customizable via the -c flag). The repository is intended for authorized security research and includes a README with usage instructions and vulnerability descriptions. No hardcoded IPs or domains are present; the user must supply the target URL. The attack vector is network-based, targeting exposed F5 BIG-IP management interfaces over HTTPS.

This repository contains two Python exploit scripts (CVE_2021_22986.py and newpoc.py) targeting CVE-2021-22986, a critical unauthenticated remote command execution vulnerability in F5 BIG-IP and BIG-IQ systems via the iControl REST API. The scripts allow an attacker to: - Check if a target is vulnerable - Execute arbitrary system commands remotely - Obtain a reverse shell on the target - Perform batch scanning of multiple targets The main attack vector is network-based, requiring access to the management interface or self IPs exposing the iControl REST API. The exploit works by sending crafted POST requests to the /mgmt/tm/util/bash endpoint, using a default or hardcoded Authorization header. The newpoc.py script also attempts to extract authentication tokens from /mgmt/shared/authn/login and /mgmt/shared/authz/tokens/ endpoints, but falls back to the same unauthenticated command execution if token extraction fails. The README.md provides detailed usage instructions, affected product versions, and references. The exploit is operational, providing both command execution and reverse shell capabilities, and is suitable for both single-target and batch exploitation scenarios.

This repository contains a Python exploit script (f5_rce.py) targeting F5 BIG-IP devices vulnerable to CVE-2021-22986, a critical unauthenticated remote code execution vulnerability. The script allows the user to execute arbitrary system commands on the target device by sending crafted POST requests to the management API endpoints. It supports both direct exploitation (using default or provided credentials) and an SSRF-based method to obtain a valid authentication token before executing commands. The script can target a single URL or perform batch exploitation from a file. The README provides usage instructions and references to the vulnerability. The main exploit logic is in f5_rce.py, which is the only code file. The script interacts with the following fingerprintable endpoints: /mgmt/tm/util/bash (for command execution), /mgmt/shared/authn/login (for token acquisition), and /mgmt/shared/authz/tokens/ (token reference). The exploit is operational, providing real command execution on vulnerable targets.