Rapid7 Vulnerability & Exploit Database

Baldr Botnet Panel Shell Upload Exploit

Back to Search

Baldr Botnet Panel Shell Upload Exploit



This module exploits an arbitrary file upload vulnerability within the Baldr stealer malware control panel when uploading victim log files (which are uploaded as ZIP files). Attackers can turn this vulnerability into an RCE by first registering a new bot to the panel and then uploading a ZIP file containing malicious PHP, which will then uploaded to a publicly accessible directory underneath the /logs web directory. Note that on versions 3.0 and 3.1 the ZIP files containing the victim log files are encoded by XORing them with a random 4 byte key. This exploit module gets around this restriction by retrieving the IP specific XOR key from panel gate before uploading the malicious ZIP file.


  • Ege Balcı <egebalci@pm.me>






Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/baldr_upload_exec
msf exploit(baldr_upload_exec) > show targets
msf exploit(baldr_upload_exec) > set TARGET < target-id >
msf exploit(baldr_upload_exec) > show options
    ...show and set options...
msf exploit(baldr_upload_exec) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security