@@ -15,13 +15,16 @@ def initialize(info = {})
15
15
'Name' => 'F5 BigIP Backend Cookie Disclosure' ,
16
16
'Description' => %q{
17
17
This module identifies F5 BigIP load balancers and leaks backend
18
- information (pool name, backend's IP address and port, routed domain) through cookies inserted by the BigIP system.
18
+ information (pool name, backend's IP address and port, routed domain)
19
+ through cookies inserted by the BigIP system.
19
20
} ,
20
- 'Author' => [ 'Thanat0s <thanspam[at]trollprod.org>' ,
21
- 'Oleg Broslavsky <ovbroslavsky[at]gmail.com>' ,
22
- 'Nikita Oleksov <neoleksov[at]gmail.com>' ,
23
- 'Denis Kolegov <dnkolegov[at]gmail.com>'
24
- ] ,
21
+ 'Author' =>
22
+ [
23
+ 'Thanat0s <thanspam[at]trollprod.org>' ,
24
+ 'Oleg Broslavsky <ovbroslavsky[at]gmail.com>' ,
25
+ 'Nikita Oleksov <neoleksov[at]gmail.com>' ,
26
+ 'Denis Kolegov <dnkolegov[at]gmail.com>'
27
+ ] ,
25
28
'References' =>
26
29
[
27
30
[ 'URL' , 'http://support.f5.com/kb/en-us/solutions/public/6000/900/sol6917.html' ] ,
@@ -69,11 +72,11 @@ def cookie_decode(cookie_value)
69
72
host = $1. to_i ( 16 )
70
73
port = $2. to_i
71
74
host = Rex ::Socket . addr_itoa ( host , v6 = true )
72
- elsif cookie_value =~ /!(.) {104}/
75
+ elsif cookie_value =~ /!. {104}/
73
76
host = nil
74
77
port = nil
75
78
end
76
- back_end = ( host . nil? ) ? nil : "#{ host } :#{ port } "
79
+ host . nil? ? nil : "#{ host } :#{ port } "
77
80
end
78
81
79
82
def get_cookie # request a page and extract a F5 looking cookie.
@@ -92,9 +95,8 @@ def get_cookie # request a page and extract a F5 looking cookie.
92
95
# 5. Encrypted cookies - "BIGipServerWEB=!dcdlUciYEFlt1QzXtD7QKx22XJx7Uuj2I0dYdFTwJASsJyJySME9/GACjztr7WYJIvHxTSNreeve7foossGzKS3vT9ECJscSg1LAc3rc"
93
96
94
97
m = res . get_cookies . match ( /([~_\. \- \w \d ]+)=(((?:\d +\. ){2}\d +)|(rd\d +o0{20}f{4}\w +o\d {1,5})|(vi([a-f0-9]{32})\. (\d {1,5}))|(rd\d +o([a-f0-9]{32})o(\d {1,5}))|(!(.){104}))(?:$|,|;|\s )/ )
95
- cookie [ :id ] = ( m . nil? ) ? nil : m [ 1 ]
96
- cookie [ :value ] = ( m . nil? ) ? nil : m [ 2 ]
97
-
98
+ cookie [ :id ] = m . nil? ? nil : m [ 1 ]
99
+ cookie [ :value ] = m . nil? ? nil : m [ 2 ]
98
100
end
99
101
100
102
cookie
@@ -115,7 +117,7 @@ def run
115
117
# If the cookie is not found, stop process
116
118
if cookie . empty? || cookie [ :id ] . nil?
117
119
print_error ( "#{ peer } - F5 BigIP load balancing cookie not found" )
118
- break
120
+ break
119
121
end
120
122
121
123
# Print the cookie name on the first request
0 commit comments