infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update xdh_x_exec.rb 

updated description and new author.
bug/bundler_fix
JT 2015-12-06 20:10:19 +08:00
parent faac44f257
commit 14afbc6800
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
modules/exploits/multi/misc/xdh_x_exec.rb
View File

@ -13,11 +13,12 @@ class Metasploit4 < Msf::Exploit::Remote
def initialize(info = {}) def initialize(info = {})
super(update_info(info, super(update_info(info,
'Name' => 'Xdh / fBot IRC Bot Remote Code Execution', 'Name' => 'Xdh / LinuxNet perlbot / fBot IRC Bot Remote Code Execution',
'Description' => %q{ 'Description' => %q{
This module allows remote command execution on an IRC Bot developed by xdh. This module allows remote command execution on an IRC Bot developed by xdh.
This perl bot was caught by Conor Patrick with his shellshock honeypot server This perl bot was caught by Conor Patrick with his shellshock honeypot server
and is categorized by Markus Zanke as an fBot (Fire & Forget - DDoS Bot). and is categorized by Markus Zanke as an fBot (Fire & Forget - DDoS Bot). Matt
Thayer also found this script which has a description of LinuxNet perlbot.
The bot answers only based on the servername and nickname in the IRC message The bot answers only based on the servername and nickname in the IRC message
which is configured on the perl script thus you need to be an operator on the IRC which is configured on the perl script thus you need to be an operator on the IRC
@ -28,12 +29,14 @@ class Metasploit4 < Msf::Exploit::Remote
[ [
#MalwareMustDie #MalwareMustDie
'Jay Turla', # msf 'Jay Turla', # msf
'Conor Patrick' # initial discovery and botnet analysis 'Conor Patrick', # initial discovery and botnet analysis for xdh
'Matt Thayer' # initial discovery for LinuxNet perlbot
], ],
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'References' => 'References' =>
[ [
[ 'URL', 'https://conorpp.com/blog/a-close-look-at-an-operating-botnet/' ], [ 'URL', 'https://conorpp.com/blog/a-close-look-at-an-operating-botnet/' ],
[ 'URL', 'https://twitter.com/MrMookie/status/673389285676965889'],
[ 'URL', 'https://www.alienvault.com/open-threat-exchange/blog/elasticzombie-botnet-exploiting-elasticsearch-vulnerabilities' ] # details of what an fBot is [ 'URL', 'https://www.alienvault.com/open-threat-exchange/blog/elasticzombie-botnet-exploiting-elasticsearch-vulnerabilities' ] # details of what an fBot is
], ],
'Platform' => %w{ unix win }, 'Platform' => %w{ unix win },