module

Baldr Botnet Panel Shell Upload Exploit

Try Surface Command
Back to search
Disclosed
Dec 19, 2018
Created
Jul 29, 2020

Description

This module exploits an arbitrary file upload vulnerability within the Baldr
stealer malware control panel when uploading victim log files (which are uploaded
as ZIP files). Attackers can turn this vulnerability into an RCE by first
registering a new bot to the panel and then uploading a ZIP file containing
malicious PHP, which will then uploaded to a publicly accessible
directory underneath the /logs web directory.

Note that on versions 3.0 and 3.1 the ZIP files containing the victim log files
are encoded by XORing them with a random 4 byte key. This exploit module gets around
this restriction by retrieving the IP specific XOR key from panel gate before
uploading the malicious ZIP file.

Author

Ege Balcı egebalci@pm.me

Platform

PHP

Architectures

php

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/http/baldr_upload_exec
    msf exploit(baldr_upload_exec) > show targets
        ...targets...
    msf exploit(baldr_upload_exec) > set TARGET < target-id >
    msf exploit(baldr_upload_exec) > show options
        ...show and set options...
    msf exploit(baldr_upload_exec) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today