One Day SecOne Day Sec

F5 BIG-IP Vulnerability Debugging Environment Setup

Onedaysec
3 min read
0 views
docx image 1770016716783 0 15a1992e99

0x00 Preface

---

This article documents the details of building an F5 BIG-IP vulnerability debugging environment from scratch.

0x01 Introduction

---

This article will cover the following:

  • F5 BIG-IP Installation
  • F5 BIG-IP Vulnerability Debugging Environment Configuration
  • Common Knowledge

0x02 F5 BIG-IP Installation

---

1. Download the OVA file

Download page: https://downloads.f5.com/esd/productlines.jsp

Before downloading, you need to register a user and apply for an activation code. Application address: http://www.f5.com/trial

2. Installation

(1) Import OVA file in VMware Workstation

(2) Set username and password

After importing the virtual machine, enter the default username (root) and default password (default), then reset the passwords for the root user and admin user

(3) Configuration

Obtain IP via ifconfig, access https://, log in using admin credentials

Enter activation code on the configuration page

Enable SSH on the configuration page to allow SSH login

0x03 F5 BIG-IP Vulnerability Debugging Environment Configuration

---

Configuration file location reference: 'CVE-2022-1388 F5 BIG-IP iControl REST Process Analysis and Authentication Bypass Vulnerability Reproduction'

1. Locate Java process

Check processes:

ps aux |grep java

As shown in the figure below

1. Locate Java process — technical illustration 1

Locate process pid 6324, jar path /usr/share/java/rest

View process information for pid 6324:

cd /proc/6324/cwd
ll

As shown in the figure below

1. Locate Java process — technical illustration 2

Locate file /etc/bigstart/scripts/restjavad

Modify JVM_OPTIONS, add debug parameter -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8000

2. Locate service

Check status of all services:

systemctl status

Find service name corresponding to pid 6324: runit.service

After adding debug parameter, restart service:

service runit.service restart

Check if parameters have been modified:

ps aux |grep 8000

As shown in the figure below

2. Locate service — technical illustration 3

3. Enable firewall

In the Web management panel, navigate to System -> Platform -> Security

Add rules as shown below

3. Enable firewall — technical illustration 4

Remote debugging successful, as shown below

3. Enable firewall — technical illustration 5

Use tmsh to view firewall rules, refer to

https://clouddocs.f5.com/cli/tmsh-reference/v15/modules/security/security_firewall_management-ip-rules.html

Command as follows:

tmsh -c 'list /security firewall management-ip-rules'

Result as shown below

3. Enable firewall — technical illustration 6

4. Common JAR Package Locations

  • /usr/local/www/tmui/WEB-INF/lib/
  • /usr/share/java/rest

0x04 Common Knowledge

---

1. tmsh Usage

Reference Materials:

https://clouddocs.f5.com/api/tmsh/

https://clouddocs.f5.com/cli/tmsh-reference/latest/

(1) Check Version

tmsh show /sys version

(2) View All Configurations

Step-by-step Operations:

tmsh
list all-properties
y

One-click operation:

echo y | tmsh -c 'list all-properties'

(3) View user information

Step-by-step operation:

tmsh
list auth

One-click operation:

tmsh -c 'list auth'

(4) Create administrator user (web and SSH login)

Reference: https://clouddocs.f5.com/cli/tmsh-reference/v15/modules/auth/auth_user.html

Step-by-step operation:

tmsh
create auth user user123 password aaaaaaa1234 description "Admin User" shell bash partition-access add { all-partitions { role admin } }

Note that passwords must not contain special characters.

One-click operation:

tmsh -c 'create auth user user123 password aaaaaaa1234 description "Admin User" shell bash partition-access add { all-partitions { role admin } }'

(5) Delete user

Step-by-step operation:

tmsh
delete auth user test1

One-click operation:

tmsh -c 'delete auth user test1'

2. Execute commands using REST API

Administrator username and password required

Access https:///mgmt/tm/util/bash

Can execute bash commands and obtain return results

Code has been uploaded to GitHub, address as follows:

An open-source project

3. Log-related

(1) Search logs with specified keywords

grep -iR aaaaaaaa /var/log/

(2) Correspondence between web management backend and log files

Audit logs, located at System -> Logs -> audit, corresponding file /var/log/audit

User login history, located at Logins -> History, corresponding file /var/log/secure

(3) Other log locations

  • /var/log/restjavad-audit.0.log
  • /var/log/auditd/audit.log
  • /var/log/btmp
  • /var/log/wtmp
  • /var/log/lastlog

(4) View web access logs

journalctl /usr/bin/logger

Clear all:

rm -rf /var/log/journal/*
systemctl restart systemd-journald

0x05 Summary

---

After setting up the F5 BIG-IP vulnerability debugging environment, we can proceed to study the vulnerability.

Related Questions & Answers

Where are the key log files located on F5 BIG-IP for auditing and debugging vulnerabilities?

Key log files on F5 BIG-IP include audit logs at `/var/log/audit`, user login history at `/var/log/secure`, REST Java daemon logs at `/var/log/restjavad-audit.0.log`, and web access logs accessible via `journalctl /usr/bin/logger`. Additionally, search logs with `grep -iR <keyword> /var/log/` for targeted analysis, as noted in the [F5 BIG-IP Vulnerability Debugging Environment Setup](/news/f5-big-ip-vulnerability-debugging-environment-setup).

How can I execute bash commands on F5 BIG-IP using the REST API for debugging?

You can execute bash commands on F5 BIG-IP via the REST API by sending a POST request to `https://<IP>/mgmt/tm/util/bash` with administrator credentials. The response will include the command output. This method is useful for automated debugging tasks in environments like those described in the [F5 BIG-IP Vulnerability Debugging Environment Setup](/news/f5-big-ip-vulnerability-debugging-environment-setup).

What are the essential tmsh commands for managing an F5 BIG-IP system during vulnerability research?

Essential tmsh commands include checking the version with `tmsh show /sys version`, viewing all configurations via `tmsh -c 'list all-properties'`, and managing users with `tmsh create auth user` or `tmsh delete auth user`. For firewall rule inspection, use `tmsh -c 'list /security firewall management-ip-rules'`. Detailed tmsh references are available in the [F5 BIG-IP Vulnerability Debugging Environment Setup](/news/f5-big-ip-vulnerability-debugging-environment-setup).

How do I set up a remote debugging environment for an F5 BIG-IP vulnerability analysis?

To set up remote debugging for F5 BIG-IP, first locate the Java process (e.g., `restjavad`) using `ps aux |grep java` and find its PID. Modify the JVM options in `/etc/bigstart/scripts/restjavad` to add `-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8000`, then restart the `runit.service`. Finally, enable the firewall in the Web management panel under **System > Platform > Security** to allow incoming connections on port 8000, as documented in the [F5 BIG-IP Vulnerability Debugging Environment Setup](/news/f5-big-ip-vulnerability-debugging-environment-setup).

Continue Reading