CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/exploit/multi/http/baldr_upload_exec.md
Views: 1904
Vulnerable Application
Description
This module exploits an arbitrary file upload vulnerability within the Baldr stealer malware control panel when uploading victim log files (which are uploaded as ZIP files). Attackers can turn this vulnerability into an RCE by first registering a new bot to the panel and then uploading a ZIP file containing malicious PHP, which will then uploaded to a publicly accessible directory underneath the /logs web directory.
Note that on versions 3.0 and 3.1 the ZIP files containing the victim log files are encoded by XORing them with a random 4 byte key. This exploit module gets around this restriction by retrieving the IP specific XOR key from panel gate before uploading the malicious ZIP file.
Verification Steps
Install the application
Start msfconsole
Do:
use exploit/multi/http/baldr_upload_execDo
set rhost 192.168.1.27Do:
runVerify that you get a shell on the target system
Options
TARGETURI
The URI where the Baldr panel/gateway is located on the target web server.