Baldr Botnet Panel Shell Upload Exploit

This module exploits an arbitrary file upload vulnerability within the Baldr
stealer malware control panel when uploading victim log files (which are uploaded
as ZIP files). Attackers can turn this vulnerability into an RCE by first
registering a new bot to the panel and then uploading a ZIP file containing
malicious PHP, which will then uploaded to a publicly accessible
directory underneath the /logs web directory.

Note that on versions 3.0 and 3.1 the ZIP files containing the victim log files
are encoded by XORing them with a random 4 byte key. This exploit module gets around
this restriction by retrieving the IP specific XOR key from panel gate before
uploading the malicious ZIP file.