What Goes Around Comes Back Around - Exploiting Fundamental Weaknesses in Botnet C&C Panels!
summary
Methodology shows reverse attacks against real C&C panels over months, combining malware reverse engineering to extract RC4 auth keys and automated Google-dork scanning to discover panels; gates resolve to the main control on the same host in roughly 90% same server cases and multiple Zeus/Citadel instances appear per host. Exposed installation and reports directories let attackers refresh DBs and download archived exfiltrated data; default ZAMP/FTP creds and port mapping reveal admin interfaces and allow uploading a c99 web shell to gain full control.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:11Disclaimer !
- 1:38What This Talk is All About?
- 2:20Rationale !
- 2:48C&C Panels Overview
- 4:01C&C Components Protection
- 6:26C&C Gates
- 7:42C&C Attack Models
- 10:34Network Traffic Analysis (2)
- 12:01Multiple C&C Panels - Same Server
- 12:57Multiple C&C Panels - Server
- 14:44Confirming Base C&C Components
- 15:39Installation Component Check
- 18:43Port Mapping for Similar Resources
- 20:21C&C Deployment on XAMPP
- 22:53Root Directory Verification
- 23:24Vulnerability Hunting!
- 24:15Remote Management Shells!
- 26:02Conclusion
- 26:30Future Work
- 26:58Questions and Queries!
related talks
35mCrimeware Chaos: Empirical Analysis of HTTP-Based Botnet C&C Panels
36mBehind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
39mHow to think like a hacker
01h 02mDIY Command & Control For Fun And *No* Profit
46mAttacks, Lies and the Underground World
42mStart Covering Your Bases And Stop Chasing APT Headlines
26mTracking the World's Dumbest Cyber Mercenaries
55mRevealing the Attack Operations Targeting Japan