Downloaded 16 times
![Securing
Mechanisms if(empty($list[SBCID_BOT_VERSION]) ||
empty($list[SBCID_BOT_ID]))die();
if(!connectToDb())die();
$botId = str_replace("x01", "x02", trim($list[SBCID_BOT_ID]));
$botIdQ = addslashes($botId);
$botnet = (empty($list[SBCID_BOTNET])) ? DEFAULT_BOTNET :
str_replace("x01", "x02", trim($list[SBCID_BOTNET]));
$botnetQ = addslashes($botnet);
$botVersion = toUint($list[SBCID_BOT_VERSION]);
$realIpv4 = trim((!empty($_GET[’ip’]) ? $_GET[’ip’] :
$_SERVER[’REMOTE_ADDR’]));
$country = getCountryIpv4();
$countryQ = addslashes($country);
$curTime = time();
Extracted Code from gate component:
Gate
Component
Cryptographic
Key
Login Page Key](https://image.slidesharecdn.com/acloserlookonccpanels-150811173117-lva1-app6891/85/A-Closer-Look-on-C-C-Panels-17-320.jpg)
![Securing
Mechanisms
Gate
Component
Cryptographic
Key
Login Page Key
Encryption and authentication
RC4 algorithm
Hard-coded in configuration file
Zeus and Citadel
$config[’mysql_host’] = ’localhost’;
$config[’mysql_user’] = ’specific_wp1’;
$config[’mysql_pass’] = ’X8psH64kYa’;
$config[’mysql_db’] = ’specific_WP’;
$config[’botnet_timeout’] = 1500;
$config[’botnet_cryptkey’] = ’pelli$10pelli’;
Extracted from configuration file:](https://image.slidesharecdn.com/acloserlookonccpanels-150811173117-lva1-app6891/85/A-Closer-Look-on-C-C-Panels-18-320.jpg)
![Securing
Mechanisms
Gate
Component
Cryptographic
Key
Login Page Key
Added authentication feature
Without login page key:
• www.cc-server.com/panel/index.php
With login page key:
• www.cc-server.com/panel/index.php?key=[value]](https://image.slidesharecdn.com/acloserlookonccpanels-150811173117-lva1-app6891/85/A-Closer-Look-on-C-C-Panels-19-320.jpg)
Uploaded byTandhy Simanjuntak
A Closer Look on C&C Panels
The document presents strategies for exploiting and securing command and control (C&C) panels used by botnets, discussing techniques for detection and evidence collection such as Google dorks and network traffic analysis. It outlines various compromise methods including vulnerabilities in software deployment, weak passwords, and insecure configurations. Additionally, it highlights the necessary securing mechanisms and references to significant research materials within the cybersecurity domain.
More Related Content
Similar to A Closer Look on C&C Panels
![[2.1] Web application Security Trends - Omar Ganiev](https://cdn.slidesharecdn.com/ss_thumbnails/2-150301070554-conversion-gate02-thumbnail.jpg?width=640&height=640&fit=bounds)
A Closer Look on C&C Panels
- 1. ACloser look onC&C Panels Seminaron Practical Security Tandhy Simanjuntak Exploiting Fundamental Weaknesses in Botnet Command and Control (C&C) Panels What Goes Around Comes Back Around ! Aditya K Sood BlackHat 2014 08/10/2015
- 2. Agenda Introduction Detection Methods SecuringC&C Panels Compromise Methods
- 3.
- 4. Introduction A collectionof internet-connected compromised machines To perform objectives in the hand of Bot master Malicious Ex. Zeus, Ice 1X, Citadel, SpyEye, and Athena What is Botnet
- 5. Introduction Machine tomanage bot Send instructions and receive data C&C Servers
- 6. Introduction How ItWorks Infectthe system Gather credentials-PII Upload data to C&C Server
- 7.
- 8. Detection Methods Google Dorks NetworkTrafficAnalysis Public C&CTrackers
- 9. Detection Methods Google Advance searchtechniques i.e. inurl, intitle, filetype , etc.Google Dorks NetworkTraffic Analysis Public C&C Trackers
- 10. Detection Methods Citadel or Zeus- inurl:“cp.php?m=login” ICE IX - inurl:“adm/index.php?m=login” SpyEye - inurl:“/frmcp/” iStealer - inurl: “/index.php?action=logs” intitle:“login” Beta Bot - inurl:“login.php” intext:“myNews Content Manager” Google Dorks NetworkTraffic Analysis Public C&C Trackers
- 11. Detection Methods Monitor traffics Google Dorks NetworkTraffic Analysis PublicC&C Trackers Plasma HTTP Bot example traffic :
- 12. Detection Methods Independent researchers GoogleDorks NetworkTraffic Analysis Public C&C Trackers • Cyber Crime Tracker - http://cybercrime- tracker.net/index.php • Zeus Tracker - https://zeustracker.abuse.ch/ • SpyEye Tracker - https://spyeyetracker.abuse.ch/ • Palevo Tracker - https://palevotracker.abuse.ch/ • Feodo Tracker - https://feodotracker.abuse.ch/ • Daily Botnet Statistics - http://botnet- tracker.blogspot.com/
- 13.
- 14.
- 15. Securing Mechanisms Gate Component CryptographicKey Login Page Key
- 16. Securing Mechanisms Act as agateway Verify host identity Transmit to C&C Panel Gate.php Gate Component Cryptographic Key Login Page Key
- 17. Securing Mechanisms if(empty($list[SBCID_BOT_VERSION]) || empty($list[SBCID_BOT_ID]))die(); if(!connectToDb())die(); $botId= str_replace("x01", "x02", trim($list[SBCID_BOT_ID])); $botIdQ = addslashes($botId); $botnet = (empty($list[SBCID_BOTNET])) ? DEFAULT_BOTNET : str_replace("x01", "x02", trim($list[SBCID_BOTNET])); $botnetQ = addslashes($botnet); $botVersion = toUint($list[SBCID_BOT_VERSION]); $realIpv4 = trim((!empty($_GET[’ip’]) ? $_GET[’ip’] : $_SERVER[’REMOTE_ADDR’])); $country = getCountryIpv4(); $countryQ = addslashes($country); $curTime = time(); Extracted Code from gate component: Gate Component Cryptographic Key Login Page Key
- 18. Securing Mechanisms Gate Component Cryptographic Key Login Page Key Encryptionand authentication RC4 algorithm Hard-coded in configuration file Zeus and Citadel $config[’mysql_host’] = ’localhost’; $config[’mysql_user’] = ’specific_wp1’; $config[’mysql_pass’] = ’X8psH64kYa’; $config[’mysql_db’] = ’specific_WP’; $config[’botnet_timeout’] = 1500; $config[’botnet_cryptkey’] = ’pelli$10pelli’; Extracted from configuration file:
- 19. Securing Mechanisms Gate Component Cryptographic Key Login Page Key Addedauthentication feature Without login page key: • www.cc-server.com/panel/index.php With login page key: • www.cc-server.com/panel/index.php?key=[value]
- 20.
- 21. Compromised Methods Malware RE Backdoor accessto Hosting Server C&C PanelsWeaknesses
- 22. Malware RE Backdoor accessto Hosting Server C&C Panels Weaknesses Compromised Methods Obtain the malware Obtain RC4 key via memory dump Upload remote management shells to server via upload vulnerability • Block .php, .php3, .php4, .php5, .php, .asp, .aspx, .exe, .pl, .cgi, .cmd, .bat, .phtml, .htaccess • Apache treats .php. as a valid .php file.php.
- 23. Malware RE Backdoor accessto Hosting Server C&C Panels Weaknesses Compromised Methods
- 24. Find others’ vulnerabilities Uploadremote management shells Notorious Datacenter support systems – Pwning through outer sphere: Exploitation Analysis of Help Desk Systems Malware RE Backdoor access to Hosting Server C&C Panels Weaknesses Compromised Methods
- 25. Malware RE Backdoor accessto Hosting Server C&C PanelsWeaknesses Compromised Methods Insecure Deployment Exposed Directory Structure Unprotected Components SQL Injection, XSS Open Ports Weak Password and Login Page Key
- 26. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Open Ports Weak Password and Login Page Key Third party software. •i.e. XAMPP. ”XAMPP is not meant for production use but only for development environments. The way XAMPP is configured is to be open as possible to allow the developer anything he/she wants. For development environments this is great but in a production environment it could be fatal” Here a list of missing security in XAMPP: 1. The MySQL administrator (root) has no password. 2. The MySQL daemon is accessible via network. 3. ProFTPD uses the password "lampp" for user "daemon". 4. PhpMyAdmin is accessible via network. 5. Examples are accessible via network. https://www.apachefriends.org/faq_linux.html
- 27. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Open Ports Weak Password and Login Page Key Exposed Directory Structure • /adm • /config • /redirect • /_reports • /install • /theme
- 28. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Open Ports Weak Password and Login Page Key
- 29. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Open Ports Weak Password and Login Page Key
- 30. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Ports Mapping Weak Password and Login Page Key
- 31. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Ports Mapping Weak Password and Login Page Key
- 32. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Ports Mapping Weak Password and Login Page Key
- 33. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Ports Mapping Weak Password and Login Page Key Citadel C&C Panel:
- 34. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Ports Mapping Weak Password and Login Page Key Citadel C&C Panel:
- 35. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection, XSS Ports Mapping Weak Password and Login Page Key
- 36. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection Ports Mapping Weak Password and Login Page Key Find other open ports to get resources
- 37. Compromised Methods Insecure Deployment Exposed DirectoryStructure UnprotectedComponents SQL Injection Ports Mapping Weak Password and Login Page Key
- 38.
- 39. References 1. Sood, A.K. (2014). Exploiting Fundamental Weaknesses in Botnet Command and Control (C&C) Panels: What Goes Around Comes Back Around !. BlackHat 2014, LasVegas, USA, 2014. 2. WebSense (2014).Putting Cyber Criminals on Notice: WatchYour Flank. Web. Aug 8, 2015. http://community.websense.com/blogs/securitylabs/archive/2014/06/12/zeus-c-amp-c- vulnerability.aspx 3. Internet Security (2011). Meet Ice IX, Son Of ZeuS. Web. Agt 8 2015. http://www.internetsecuritydb.com/2011/08/meet-ice-ix-son-of-zeus.html 4. Sherstobitoff, R. (2013). Inside the World of the Citadel Trojan. Executive Summary, McAfee Labs. 5. Donohue, B. (2013).The Big Four Banking Trojans. Kaspersky Lab. Web. Aug 8, 2015. https://blog.kaspersky.com/the-big-four-banking-trojans/ 6. Jones, J. (2013). Athena, a DDoS Malware Odyssey. Arbor NetworksThreat Intelligence. Web. Aug 8 2015. https://asert.arbornetworks.com/athena-a-ddos-malware-odyssey/ 7. Gallagher, S. (2014). Feds warn first responders of dangerous hacking tool: Google Search. Ars Technica. Web. Aug 8 2015. http://arstechnica.com/security/2014/08/feds-warn-first-responders- of-dangerous-hacking-tool-google- search/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2 Findex+%28Ars+Technica+-+All+content%29 8. Apache Friend (n.d.) Linux Frequently Asked Questions. Web. Aug 8 2015. https://www.apachefriends.org/faq_linux.html
Editor's Notes
- #2 Abstracts Botnet, a collection of internet-connected compromised machines use to perform objectives in the hand of Bot master. Botnet refers to the malicious one because the recruitment process uses a malicious software and executed within the machine. Bot master uses Command and Control (C&C) to control its botnet, to send instructions or to receive data. Bot master uses C&C Panel which acts as an interface to its botnet for a way to communicate. The presentation will cover C&C Panel mostly used by Zeus, ICE II, Citadel and Athena, and describe further on how to exploit the weaknesses of the C&C Panel. The Presentation is taken from BlackHat 2014 "Exploiting Fundamental Weaknesses in Botnet Command and Control (C&C) Panels" by Aditya K Sood.
- #7 WebSense (2014).Putting Cyber Criminals on Notice: Watch Your Flank. Web. Aug 8, 2015. http://community.websense.com/blogs/securitylabs/archive/2014/06/12/zeus-c-amp-c-vulnerability.aspx
- #10 http://arstechnica.com/security/2014/08/feds-warn-first-responders-of-dangerous-hacking-tool-google-search/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29
- #11 http://arstechnica.com/security/2014/08/feds-warn-first-responders-of-dangerous-hacking-tool-google-search/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29
- #15 https://pixabay.com/get/52972f3a772794c94c16/1439055210/padlock-40192_1280.png?direct
- #24 http://community.websense.com/blogs/securitylabs/archive/2014/06/12/zeus-c-amp-c-vulnerability.aspx
- #27 https://www.apachefriends.org/faq_linux.html