Command Injection in F5 iRules
summary
F5 BigIP iRules allow unquoted or command-substituted TCL arguments that lead to remote code execution and persistent in-memory implants; demo exploits use TCP::respond, semicolon/brace injection and cache poisoning via table set to become a stored man‑in‑the‑middle and pivot to localhost services. Tools shown: Burp Repeater + the iRule detector BApp, a Rust tclscan fork and Testicle unit tests. Examples include a vulnerable HSSR snippet, MC PD queries revealing local users and possible private keys, and working port‑scan/FTP pivots.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:31Christopher
- 4:11What is iRules
- 6:13iRules the language
- 7:37Script example
- 8:15Server header
- 9:00HTTP server
- 9:58Syntax
- 11:25Decalogue
- 14:02Quotes
- 18:06Code Example
- 20:22Exploit
- 21:12Demo
- 24:47Table and Table
- 25:20Table Syntax
- 26:00Example
- 36:54Request
- 37:41TMSH
- 39:24Attack Chain
- 42:18Unit Testing
- 43:29Summary
- 45:11Questions
related talks
26mJourney to Command Injection: Hacking the Lenovo ix4-300d
42mModern web application bugs
27mThe Perl Jam 2: The Camel Strikes Back
51mPrompt Injection: When Hackers Befriend Your AI
47mUnderstanding Prompt Injection - Techniques, Challenges, and Advanced Escalation
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
39mHow to think like a hacker
01h 04mServer-Side Browsing Considered Harmful