On the server side it's driven by PHP with MySQL as the backend. File structure is similar to other packs. One noticable difference in the way statistics are tracked, as all packs track visitors and these numbers are used in marketing of packs.
Armitage has an additional section to calculate how many visitors were actually compromised. Typically this is done by recording how many people request a download of a loader (trojan binary) which means the exploit worked. However, this does not account for the fact that loader may have been blocked on the client due to various defenses. Any pack's job is to deliver an exploit and load some binary and many packs are satisfied with just recording such requests. In Armitage's case it is accomplished by recording an additional request which must be made by this loader. This statistic will represent how many devices have been compromised and have gotten the loader to fully execute and check-in. It is unclear why this decision was made for a generic pack since loaders will now have to be specifically written to perform this check-in function. Such loader was not distributed with the pack itself so it is possible that this was not written for general public.
"config.php"
Contains password variables for admin and guest.
"db.php"
Defines variables needed to establish database connection (host, schema, user, and password).
"install.php"
Establishes a database connection and creates the necessary tables. Once complete shows a link to admin page and required credentials.
"admin.php"
Defines two valid accounts admin and guest. Shows traffic and loads statistics as well as has the ability to upload a new trojan and change passwords.
"index.php"
Defines various functions which identify the visitor based on UAS.
Creates the URL for loader "exe.php" and if GET contains "?ex=" integer then this value will be passed to "exe.php?ex=".
Checks visitor's IP address for previous visits and aborts if one is found. String "^_~" is returned upon abort.
Identifies the browser, the following list is used: Opera, Konqueror, Lynx, Links, Internet Explorer, Netscape, Firefox, Mozilla, Other.
Identifies the OS with the following list: Windows (95, NT 4, 98, ME, 2000, XP, 2003, Vista), Linux, Mac OS, Other.
Identifes the Country based on GeoIP library from visitor's IP address. Geoip files are borrowed from Icepack.
Updates statistics for HTTP Referrer, domain only. Sanitizes the referrer domain to avoid SQL injection.
Updates statistics for Browser, OS, and Country. Inserts visitor's IP address and time of visit.
Exploit is served for Internet Explorer from "e.php", for Opera from "opera.php", and Firefox from "ff.php".
"exe.php"
Second stage of the exploit sequence, which serves the binary file. By default it is "./load/file.exe", but if GET "?ex=" integer was set then file with that value is delivered (eg: "./load/file20.exe"). Identifies the visitor (Browser, OS, Country) and updates "loads" statistics table.
"lds.php"
Identifies the Country based on Geoip of the connection and updates the "ots" (otstuk) statistics table. This is the place where loader's check-in stats are kept.
"e.php"
Serves the MDAC exploit slightly obfuscated. CVE-2006-0003 ; MS06-014 ; MDAC (BD96C556-65A3-11D0-983A-00C04FC29E36). If this fails then will load "bof.php".
"bof.php"
Contains the shellcode for buffer overflow exploits.
Serves the WFI exploit. CVE-2006-3730 ; MS06-057 ; "WebViewFolderIcon.WebViewFolderIcon.1.setSlice()".
At the end display the 404 Not Found page which is fake since real HTTP Status code is still 200 OK.
"ff.php"
Serves exploits for Firefox browsers
"opera.php"
Serves exploits for Opera browsers
No comments:
Post a Comment