**kravietz 🦇** @kravietz@social.privacytools.io · 2021-03-23T21:19:05Z

kravietz 🦇 @kravietz@social.privacytools.io

kravietz 🦇 @kravietz@social.privacytools.io

Code from highly respected F5 enterprise web security appliances basically runs tar as root on input from HTTP at /mgmt/tm/util/bash URL 🤔 And it's 2021.

e895fd268e49e5b2.png

Mar 23, 2021, 21:19 · · · ·

**That guy over there ن** @thatguyoverthere@social.odayacres.farm · Mar 23, 2021, 21:21

**That guy over there ن** @thatguyoverthere@social.odayacres.farm · Mar 23, 2021, 21:21

Mar 23, 2021, 21:21

That guy over there ن @thatguyoverthere@social.odayacres.farm

@kravietz what could possibly go wrong?

**kravietz 🦇** @kravietz@social.privacytools.io · Mar 23, 2021, 21:30

**kravietz 🦇** @kravietz@social.privacytools.io · Mar 23, 2021, 21:30

Mar 23, 2021, 21:30

kravietz 🦇 @kravietz@social.privacytools.io

@thatguyoverthere

Just an extra admin console :)

https://github.com/h4x0r-dz/RCE-Exploit-in-BIG-IP/blob/main/f5_rce.py

**That guy over there ن** @thatguyoverthere@social.odayacres.farm · Mar 23, 2021, 21:30

**That guy over there ن** @thatguyoverthere@social.odayacres.farm · Mar 23, 2021, 21:30

Mar 23, 2021, 21:30

That guy over there ن @thatguyoverthere@social.odayacres.farm

@kravietz It's good to leave the backdoor open in case you forget your keys right?

**That guy over there ن** @thatguyoverthere@social.odayacres.farm · Mar 23, 2021, 21:34

**That guy over there ن** @thatguyoverthere@social.odayacres.farm · Mar 23, 2021, 21:34

Mar 23, 2021, 21:34

That guy over there ن @thatguyoverthere@social.odayacres.farm

@kravietz 77 lines to own a "security" appliance 🤣

**kravietz 🦇** @kravietz@social.privacytools.io · Mar 23, 2021, 21:35

**kravietz 🦇** @kravietz@social.privacytools.io · Mar 23, 2021, 21:35

Mar 23, 2021, 21:35

kravietz 🦇 @kravietz@social.privacytools.io

@thatguyoverthere

A *Respected* Enterprise Security Appliance!

Resources

Developers

What is Mastodon?

social.privacytools.io

More…