Our honeypots have been busy collecting exploit attempts for CVE-2020-5902, the F5 Networks BigIP vulnerability patched last week. Most of the exploits can be considered recognizance. We only saw one working exploit installing a backdoor. Badpackets reported seeing a DDoS bot being installed. Thanks to Renato for creating a partial map of the IPs hitting our honeypot so far: The simplest way to achieve limited command execution is the use of BigIP command-line interface commands. But the function is a bit limited. However, to achieve full-featured command execution, it is possible to just create an alias that points to "bash". The result is full code execution in three steps (these requests can us POST or GET. I am using GET here to make them easier to display): 1. Create an "alias" to map the "list" command to "bash"
2. Write a file to /tmp with the command to be executed
3. Use the alias to execute the command.
4. Optionally: remove the alias.
If you do not need code execution, you can also use "Step 2" to write files, or you can just read arbitrary files in one step using:
Instead of defining an alias, the technique in step '1' can also be used to execute BigIP CLI command directly, for example, to retrieve password hashes (note this only work if the alias is not defined):
Most of the commands I have seen so far are "id", "ls" and retrieving files like "/etc/paswd" and the BigIP license file. More interesting commands: * Adding a backdoor root account:
* Adding a backdoor cron job:
which retrieves:
this will check the URL once a minute for updates via cron. So far, I have not seen any other scripts return. Interestingly, after sending an abuse complaint to the ISP hosting the script, my home IP can no longer connect to the site. --- |
Johannes 4504 Posts ISC Handler Jul 7th 2020 |
Thread locked Subscribe |
Jul 7th 2020 1 year ago |
"Interestingly, after sending an abuse complaint to the ISP hosting the script, my home IP can no longer connect to the site."
Have you contacted RIPE NCC to trigger an investigation on the ISP ? |
Anonymous |
Quote |
Jul 7th 2020 1 year ago |
will consider that if I see them do that more frequently.
|
Johannes 4504 Posts ISC Handler |
Quote |
Jul 7th 2020 1 year ago |
Sign Up for Free or Log In to start participating in the conversation!